The origin of the notification — whether generated by the app itself, a third-party notification service, or another source — remained unknown, and available information did not independently establish that SecuX's app or infrastructure was compromised.