Your organization might already have an active user… Who no longer works there. No breach notification. No warning signs.

source