Unauthorized activity is any access or action on a system that the owner did not approve. It can include logging in with stolen credentials, changing settings, copying files, running malicious code, or moving laterally inside a network. In cyber security, the term matters because it helps separate normal use from suspicious behavior that may indicate compromise, abuse, or policy violation.
Defenders look for unauthorized activity in authentication logs, endpoint alerts, file access records, and network traffic. In an extortion or ransomware case, a victim name or public claim does not prove a breach by itself, but it does justify checking for unauthorized activity across accounts, servers, and cloud services. Confirming whether anything happened without approval is often the first step in deciding if an incident is real and how far it has spread.