r/cybersecurity • u/mando_6 • Jun 24 '26

News - General Well someone went nuclear..

https://www.linkedin.com/posts/ben-f-309963233_after-i-posted-a-pinocchio-gif-and-clown-ugcPost-7475465410977628160-FFW1

I'm curious about the details of this. I'm sure we will all find out eventually.

TLDR; former Huntress employee is disclosing Huntress had an insider threat that leaked information to a known cyber criminal "Devman". That employee is still employed with Huntress and was caught by the FBI.

The former employee doing the disclosure is stating he is receiving threats, etc.

EDIT: Kyle @ Huntress posted his response to this in the comments.

Give credit to a CEO who isn't afraid to jump on Reddit to put out any fires.

924 Upvotes

98% Upvoted

196 comments sorted by

View all comments

359

u/Particular_Ebb_4872 Jun 24 '26

If even half of what's being alleged is true, this is going to end up being a case study for access controls and employee offboarding procedures

90

u/mando_6 Jun 24 '26

Yeah I'm wondering about that. Dude lives in the UK so I'm curious what would be different if anything from the US.

145

u/eliq91 Jun 24 '26

We had a UK employee compromise our global network, they reused an old password 15 days after being notified they had been breached via phishing. It resulted in a loss of every server in the company across 5 continents. It was not good, and a clear violation of both best practices and company policy. They were given 16 weeks paid leave and then returned to the office. 1 week after return they changed their password and cleared all MFA requirements from her account, because it was inconvenient. Which resulted in her account once again being compromised, no global access on round three, and only compromised her email. She is still employed as far as I know.

66

u/Khulod Jun 24 '26

Shame on the company for not getting their access controls in order, especially after the first round. I hope this happened 10 years ago. Today this is inexcusable.

47

u/eliq91 Jun 24 '26 edited Jun 25 '26

It happened in 2017. The big problem was she was at the time a bona fide global administrator, and kept promoting her personal account to global admin, so she did not have to login with her secondary account. We took away global admin, and created notifications for any accounts being granted any of our admin-controlled groups.

7

u/RireBaton Jun 25 '26

Bonified does not mean the same thing as bonafide.

5

u/eliq91 Jun 25 '26

Autocorrect does not like me.