insider threat3 articles
Nobody Revoked His Access. He Noticed.
A terminated employee caused hundreds of thousands of dollars in damage and significant project delays after their company failed to revoke their system access, allowing them to delete files, lock out accounts, and corrupt a database. The lapse occurred because HR and IT each assumed the other was responsible for cutting off access, leaving the former employee's credentials active for several days. The incident highlights the need for clear offboarding protocols, including same-day access revocation and regular reviews of shared admin credentials.
The Guy Hired to Catch Spies Was Busy Being One
Nathan Vilas Laatsch, a 29-year-old IT specialist who worked in the DIA's Insider Threat Division, pleaded guilty after being caught in an FBI sting operation passing classified information to what he believed were foreign spies. Ironically, his role at the DIA involved identifying potential leakers and supporting internal investigations, knowledge he intended to exploit to avoid detection. He was arrested in May 2025 after making two dead-drops of top-secret documents in an Arlington, Virginia park, having transcribed the classified information by hand and hidden the notes in his socks.
Myspace93 Breach: 46,000 Plaintext Passwords Finally Surface, Five Years Late
In January 2021, Myspace93 — a parody site mimicking the old social network — suffered a breach in which trusted members of a Discord community exploited beta app access to steal server files, including an unencrypted store containing the plaintext usernames, passwords, email addresses, and IP addresses of over 46,000 users. The site's co-creator, known as jankenpopp, blamed the betrayal on individuals he considered close collaborators, who concealed the theft and shared stolen data and download tools among themselves. The breach has only recently been highlighted after HaveIBeenPwned ingested the data more than five years later, and affected users are advised to change any reused passwords and enable two-factor authentication.