If you’re talking about a specific thing that’s happened, what likely happened is the attacker just deleted the logs of their activities.