Lol 'breaches'.

I agree with other posters that you seem to be capable of network level forensics, but you have said nothing to back up what you consider a device breach other than 'some cloud destined network traffic which disapears after a hard reset'.

In my experience of forensic reports, this link is tenuous at best and would not be considered evidence or even suspected breach based on that alone.