Terminated employee cost company hundreds of thousands of dollars because nobody revoked access

PWNED: Terminated Worker's Enduring Access Costs Company Hundreds of Thousands

In a story recounted by Yad Senapathy, CEO of the Project Management Training Institute in Dallas, an ex-employee caused significant damage to their former employer's systems. Senapathy worked at the company with over 1,000 employees, and when a staff member was terminated, they retained access to internal systems.

The disgruntled worker deleted files, locked out others, and corrupted a database, causing extensive damage. It took several days before anyone realized the issue, as HR and IT were not clearly assigned to revoke the ex-employee's access. Responsibility and set deadlines were lacking, allowing the breach to persist.

The terminated employee had access to admin credentials, account controls, and project tracking systems, which then granted unauthorized access to other systems. This led to a cascade of inappropriate access, costing the company hundreds of thousands of dollars. Recovery was particularly challenging because the person who caused the damage was the only one who knew how to fix the systems.

Senapathy emphasizes the importance of offboarding checklists and access reviews, suggesting they should be as crucial as "return the laptop" on the list. The real problem was the terminated employee's excessive access, making it difficult for IT to determine what needed to be cut off. A swift deletion of access and forced re-review of shared account access could have prevented this incident.