A former IT employee at an unnamed company took advantage of a delay in locking his accounts after his dismissal and caused the company significant financial and operational losses. He deleted work files, locked out colleagues' accounts, and corrupted the corporate database.
A former IT employee at an unnamed company took advantage of a delay in locking his accounts after his dismissal and caused the company significant financial and operational losses. He deleted work files, locked out colleagues' accounts, and corrupted the corporate database.
The incident was reported by Yad Senapati, CEO of the Project Management Training Institute in Dallas, in an article for The Register. The incident occurred at a company with more than 1,000 employees where Senapati previously worked.
After one specialist was fired, his credentials remained active for several days due to a lack of clear division of responsibility between departments. HR believed that access would be automatically revoked by IT, while IT specialists waited for an official order from HR.
As a result, the former employee retained access to shared administrative accounts, account management systems, and project trackers. This allowed him to cause a chain reaction of unauthorized access and intentionally damage critical infrastructure. The recovery process was complicated by the fact that this specialist had the greatest knowledge of the architecture of the affected systems.
«This employee wasn’t some genius hacker. He just had access even after he was fired, and no one changed his credentials or checked his administrative rights. We allowed one person to accumulate so much knowledge about the system that it took longer than it should have to close the door behind him,» said Yad Senapati.
The organization’s direct losses amounted to hundreds of thousands of dollars. Additionally, the company suffered weeks of delays in implementing a key project.
