You are a security analyst at a healthcare organization. The organization uses Cisco Stealthwatch for network visibility and a SIEM for event correlation. You receive an alert that a medical records database server (IP 10.0.3.20) is communicating with an external IP (198.51.100.100) on port 22 (SSH) at 2:00 AM. The database server should have no outbound SSH connections; only remote administration is allowed from a management subnet via VPN. You check Stealthwatch and see that the connection duration is 30 minutes and the volume of data transferred is 500 MB. The database server logs show no local account logins at that time. The firewall logs show that the connection was initiated from the database server. The incident response team has been alerted. What is the most likely scenario and your immediate action?