Upon a triggering event, such as a predetermined number of received alarms, a predetermined number of positive hacked identifications, or any other threshold, the Level 1 monitoring center can refer the unauthorized access attempt to an appropriate Level 2 center for possible retaliatory and/or legal action.