My guess is it was the only obvious evidence of an attack.
replyGill probaby already knows this but for the uninitiated: something logged in, did a thing to potentially every container, and then deleted any sign of it doing the thing.
replyall that's left is a single timestamp of a log or something getting deleted