I don't think that proves they've been breached. Are you sure your not just seeing keep alive traffic or something random you haven't taken into account ?