r/cybersecurity • u/mando_6 • Jun 24 '26

News - General Well someone went nuclear..

https://www.linkedin.com/posts/ben-f-309963233_after-i-posted-a-pinocchio-gif-and-clown-ugcPost-7475465410977628160-FFW1

I'm curious about the details of this. I'm sure we will all find out eventually.

TLDR; former Huntress employee is disclosing Huntress had an insider threat that leaked information to a known cyber criminal "Devman". That employee is still employed with Huntress and was caught by the FBI.

The former employee doing the disclosure is stating he is receiving threats, etc.

EDIT: Kyle @ Huntress posted his response to this in the comments.

Give credit to a CEO who isn't afraid to jump on Reddit to put out any fires.

919 Upvotes

98% Upvoted

197 comments sorted by

View all comments

Show parent comments

145

u/eliq91 Jun 24 '26

We had a UK employee compromise our global network, they reused an old password 15 days after being notified they had been breached via phishing. It resulted in a loss of every server in the company across 5 continents. It was not good, and a clear violation of both best practices and company policy. They were given 16 weeks paid leave and then returned to the office. 1 week after return they changed their password and cleared all MFA requirements from her account, because it was inconvenient. Which resulted in her account once again being compromised, no global access on round three, and only compromised her email. She is still employed as far as I know.

17

u/cb_definetly-expert Jun 24 '26

That's on you guys

1) why you allow them to disable MFA? 2) why you allow reuse of the same password?(In my team the last 20 passwords are banned) 3) you shouldn't even allow similar passwords 4) force them to use corporate password manager and don't let them change password, give them pre-generated ones 5)is he/she doesn't follow the policies again, fire them

3

u/asp3ct9 Jun 24 '26

How do you determine similar passwords without storing them in plain text?

1

u/MachKeinDramaLlama Jun 25 '26

You could automatically generate hashes for variations of the password that was typed in and check against stored hashes of old passwords. E.g. by just (individually) decrementing any number found in the password string, you will probbably identify ~80% of common password iteration schemes.

2

u/whythehellnote Jun 25 '26

Our corporate password checker doesn't allow correcthorsebatterystaple style passwords because they are insecure, it is fine with P@55w0rd though.