The response team discovers that a compromised credential is also used by several service accounts. What is the best next step?

1. Assess and contain the credential's full scope, coordinating rotation and service impact
2. Disable all unrelated identities permanently
3. Reset only the first observed login and stop investigation
4. Publish the credential to identify all users