We found the script that sends alerts for missing licenses was running on the wrong US timezone, between 8 PM and 11 PM of April the 30th EST we returned wrong license count, not any PBX was compromised by the defect.
The problem is corrected.
Sorry for caused inconvenience.
