Which activity does NOT indicate a data breach has occurred?

Employee data changes in a self-service portal (A) are normal activitiesunless unauthorized.

Payroll activity outside normal work hours (B), excessive file access (C), and unexplained account locks (D) may indicate security breaches.

References:

Payroll System Security Standards (Payroll.org)

IRS Data Security Guidelines