Is there a CiviCRM User Actions Log Feature?
The short answer would be &quot;no&quot; since CiviCRM is not responsible for authentication, the CMS is.
CiviCRM can be configured with various levels of logging, but as a general strategy, you'll want to make use of multiple tools when investigating security issues, which will depend on your individual setup.
For the specific issue of 'theft of user information', there is an extension that prevents administrators from downloading contact data unless given explicit permission, you might want your organization to use that going forward.
Other than that, if it's a bunch of data that was downloaded, then I'd comb the webserver logs for large downloads, find the originating ip and then look for matching login urls with the same ip.