Over and over again we see attackers who have gained unauthorized access to a system by spending a significant amount of time spying out relevant SAP data, unnoticed by the victim organization. In a recent incident, we identified a large number of information gathering and data collection activities carried out by a threat actor prior to the exfiltration of sensitive data - which, if leaked, would inevitably lead to reputation and/or financial loss for the organization.