A case study in why credentials are revoked before firings.
Twin brothers wipe 96 gov't databases minutes after being fired
https://arstechnica.com/tech-policy/2026/05/drop-database-what-not-to-do-after-losing-an-it-job/
https://arstechnica.com/tech-policy/2026/05/drop-database-what-not-to-do-after-losing-an-it-job/
A case study in why credentials are revoked before firings.
79 Comments
Cytobit@piefed.social · 175 pts · 96d
Why were they storing passwords in plaintext in the databases?!
LadyMeow@lemmy.blahaj.zone · 171 pts · 96d
First time reading about government systems, eh?
WereCat@lemmy.world · 50 pts · 96d
Why not? National Safety Department of Slovak Republic (Narodny Bezpecnostny Urad) had password NBUSK123… just government things
testaccount789@sh.itjust.works · 31 pts · 96d
No, that was a bit different.
login: nbusr
password: nbusr123
WereCat@lemmy.world · 4 pts · 95d
my bad
msage@programming.dev · 12 pts · 96d
The K in password doesnt match Republic in the name.
Totally secure.
echodot@feddit.uk · 44 pts · 96d
Because like all critical infrastructure it was setup by somebody's kid on work experience
IWW4@lemmy.zip · 20 pts · 96d
Or some poor guy who is setting it up, because it is a one off and just get it done project, that metastasizes into a fucking mess.
scytale@piefed.zip · 7 pts · 96d
Or lowest bidder contractor.
IWW4@lemmy.zip · 5 pts · 96d
All contracts go to the lowest bidder.
village604@adultswim.fan · 5 pts · 95d
Fun fact, if the federal government contracts your company for a service, you arent legally allowed to sell it others for less.
IWW4@lemmy.zip · 1 pts · 95d
Correct.
Corkyskog@sh.itjust.works · -1 pts · 95d
That's only usually true, but heavily depends on category. If someone is offering some service like software or managing employee benefits it can often be outweighed by other factors.
betterdeadthanreddit@lemmy.world · 18 pts · 96d
It's like leaving your car door unlocked in a bad neighborhood so your window doesn't get smashed for the $.36 in the center console. Attacker might take the prize and go without showing that everything around it is just as poorly-built.
JeeBaiChow@lemmy.world · 8 pts · 96d
Well how else would they help the users if they ever forgot their passwords? Duh.
/s
CosmoNova@lemmy.world · 8 pts · 96d
Probably for the same reasons web browsers store them in plain text: They don‘t care.
OwOarchist@pawb.social · 18 pts · 96d
Why one web browser stores them in plain text. Fucking Edge.
Who knows about the others, but I can pretty much guarantee you that Librewolf, for example, isn't doing that shit.
VeganCheesecake@lemmy.blahaj.zone · 13 pts · 96d
If you can autofill passwords without authenticating in some way, they are probably either stored in plaintext, or encrypted with a key that is stored in plaintext. Cause, like, how is it supposed to magically encrypt it.
wreckedcarzz@lemmy.world · 4 pts · 96d
That's how computers work, dummy. Magic.
CosmoNova@lemmy.world · 5 pts · 96d
Firefox and chromium browsers also store them in plain text. I know because I literally copied them from a file when setting up my password manager.
railwhale@lemmy.nz · 5 pts · 96d
I believe Firefox (and forks) only encrypt if you have set a master password.
FiniteBanjo@feddit.online · 1 pts · 95d
Pretty sure thats part of the illegal thing done by these two, no?
ByteJunk@lemmy.world · 112 pts · 96d
I'm not gonna say there were signs that these two weren't the most law abiding of citizens to begin with, buuuuut...
ParlimentOfDoom@piefed.zip · 32 pts · 96d
I briefly worked with a government client that would bring in prison laborers to collect trash. From the IT building of the tax agency.
But don't worry, they were just white collar criminals. You know, people who only went to jail for stealing... financial data... The very thing that was accessible in that building.
Genius.
village604@adultswim.fan · -2 pts · 95d
I don't think that you'd be able to do much with that information as a prisoner.
FiniteBanjo@feddit.online · 3 pts · 95d
You would be surprised, I'm sure there are a lot of foreign agents in US Prisons. Great place to train insurgents and radicals.
VOwOxel@discuss.tchncs.de · 15 pts · 96d
Oh I'm sure the government loved taking them, since >Half of all Politicians are corrupt fraudsters.
FiniteBanjo@feddit.online · 1 pts · 95d
OPEXUS is not the government, it's a contractor hosting government databases.
MonkderVierte@lemmy.zip · 12 pts · 96d
Relatives of El Nasir?
deegeese@sopuli.xyz · 6 pts · 96d
Company only paid for a 7 year background check, so you mis them getting out of prison 8 years ago.
AcesFullOfKings@feddit.uk · 0 pts · 96d
rekabis@lemmy.ca · 110 pts · 96d
And why couldn’t they have done that to the student loans system?
Like JFC, they could have instantly made themselves immune from trial-by-jury anywhere in America by doing that one tiny thing.
ApertureUA@lemmy.today · 32 pts · 96d
Probably not one of the 96(+) databases they had :(
DROP TABLE students
FiniteBanjo@feddit.online · 22 pts · 95d
Student loans are loans from third party lenders which are cosigned by the federal government for collateral.
Even if every government record of it were destroyed, the loan servicers would have perfect multiple ledger copies of it all.
rob_t_firefly@lemmy.world · 6 pts · 95d
Fight Clubs HATE this one simple trick!
teyrnon@sh.itjust.works · 12 pts · 96d
Peter Thiel probably has a backup copy now from doge unfortunately.
explodicle@sh.itjust.works · 8 pts · 95d
Oh for something important like that we have backups.
modus@lemmy.world · 5 pts · 96d
Wasn't that a premise in Mr Robot?
village604@adultswim.fan · 7 pts · 95d
It was kinda the premise of Fight Club, although private sector instead of public
zeroConnection@programming.dev · 86 pts · 96d
The more scary part in this story is that the government stores your passwords in plain text!
So basically ANYONE with access to the database can steal your credentials, including employees, the government and any authorities.
Never re-use passwords.
Corkyskog@sh.itjust.works · 18 pts · 95d
Every place I have worked, most of HR and like half of finance/accounting has access to your social security number, full address and phone number. Sometimes even the password and security questions you used for whatever BS portal they made you setup an account in.
pineapplelover@lemmy.dbzer0.com · 14 pts · 96d
Never heard of hashing and salting apparently
zeroConnection@programming.dev · 16 pts · 96d
"Oh yeah we did that at the last company barbeque event. They hashed and salted all the steaks"
hakunawazo@lemmy.world · 64 pts · 96d
To be fair, what else could they do with that keyboard.

Corkyskog@sh.itjust.works · 3 pts · 95d
That's like a huge key at least with 2.5x the size of a normal using USB C to estimate the ratio.
dvlsg@lemmy.world · 2 pts · 95d
It's not what that image is, but keychron released a single giant key keyboard a little while back. Similar idea at least. Sold out immediately.
SeeMarkFly@lemmy.ml · 40 pts · 96d
Only a living wage can prevent data dumps.
Upper management can't even see it...yet.
sundray@lemmus.org · 34 pts · 96d
In a row?!
everett@lemmy.ml · 38 pts · 96d
Try not to delete any databases on your way to the parking lot!
elvith@feddit.org · 11 pts · 96d
But I explicitly stated in the
CLAUDE.mdemployee guidelines to not delete production databases!ArtVandelay@lemmy.world · 10 pts · 96d
"I can't go out for a pack of smokes without running into 9 databases that you dropped!"
VicVinegar@lemmy.world · 2 pts · 95d
I met Rocco at a party for the release of the 2nd Boondock Saints DVD. He and some of the other cast gave quick speeches and then just kind of hung out with the crowd. Super, super cool guy. Easy going, humble, down to Earth. Just one of those people that could make friends with anyone.
wreckedcarzz@lemmy.world · 7 pts · 96d
Oops! All Databases
conartistpanda@lemmy.world · 3 pts · 94d
All the columns too
village604@adultswim.fan · 1 pts · 95d
Probably all at once. My guess is they had the script ready to go.
pelya@lemmy.world · 32 pts · 96d
But did they recover from backups? Don't leave the most juicy intrigue out of the story.
Speculater@lemmy.world · 15 pts · 96d
No one ever tested the backups so they don't know if they will work!
Microtonal_Banana@lemmy.zip · 28 pts · 96d
Its always interesting when people are both very smart and also very stupid at the same time.
buddascrayon@lemmy.world · 17 pts · 96d
Knowledgeable and smart are not the same thing. These two are very knowledgeable about the systems they worked on and database manipulation, believe it or not these are not hard skills to learn. But they were incredibly dumb regardless given every single action they took at every point in their lives.
dustyData@lemmy.world · 10 pts · 96d
Fun fact. In psychology assessment this are being called hard skills: very technical abilities for doing specialized tasks; and soft skills: social and emotional abilities to navigate social contexts, manage conflict and self regulate emotions.
Hard skills are easier to teach, while soft skills are very hard.
Gumus@lemmy.dbzer0.com · 18 pts · 96d
🤔
MagicShel@lemmy.zip · 2 pts · 96d
There are certain positions I would probably be very good at from a technical perspective that I avoid because I know my myself. I could never work for the CIA or FBI for example. I don't want to know their secrets because they could have me weigh a duty to execute my job and protect my family against my duty to humanity. I don't know which principle I would betray, if grappling with it didn't kill me first. Some might think that's an easy choice but the personal cost is extreme — look at Snowden.
No, keep me far away from that shit. Let me grapple with intellectual problems all day long, but moral quandaries paralyze me.
dustyData@lemmy.world · 4 pts · 95d
Interesting, such a strong insight is actually part of soft skills. You know yourself, what you don't want to do and stick up to it for your own moral preservation.
HalfSalesman@lemmy.world · 2 pts · 96d
Hard skills are either easy to teach or virtually impossible. It depends on the person. That isn't to say most people are incapable of learning: its that most people are fundamentally incurious or unmotivated, and teaching an incurious person is fucking impossible unless money is on the line for them.
Most people have very little difficulty getting very good at soft skills very early on in life. If you haven't learned them, you are in a minority. These two are likely in a minority psychological/neurological profile.
dustyData@lemmy.world · 4 pts · 96d
Well, curiosity, openness to new experiences, motivation to both learn and meet new people, tolerance to frustration and failure. Or at least be amicable enough to successfully navigate a learning setting, they are part of soft skills. In my professional experience, these are far from universal traits. Lack of soft skills is definitely not a minority, but it is also a gradient.
HalfSalesman@lemmy.world · 0 pts · 96d
Humans literally evolved highly social minds entirely to rapidly develop soft skills.
You think most people lack soft skills because you placed additional effort into developing them and likely had the head start most average human beings get. Its rare that people start at zero, but some very much do.
I did.
dustyData@lemmy.world · 3 pts · 95d
Here's an interesting example you just gave me. I don't think that and never said as much. As I said, my impression, while anecdotal, was developed doing psychological evaluations professionally. Our understanding is that soft skills are not a given, there are actually several dimensions and degrees of different soft skills involved. Some people might be very good conversationalist, but completely emotionally inflexible at work at the same time, for example. Certainly, different social advantages derive into different opportunities to develop different soft skills. This complexity is exactly why I said that soft skills are hard to teach and learn. Also, why some people on the field are calling to rename them something else. The soft adjective is perhaps inaccurate.
Now to the example. It's extremely frowned upon in a conversation to affirm what others think, when they haven't explicitly expressed so themselves. Specially when the other person is still a complete stranger. It could be interpreted as hostility or an attempt to misrepresent other people's positions in order to attack them.
HalfSalesman@lemmy.world · 2 pts · 95d
It was more or less said when you stated the very premise of "Soft Skills are hard to teach". But sure, I took a very unnuanced interpretation, that's my bad.
I'm not on lemmy to practice soft skills. To be clear: I'm not exactly hostile, just cynical and impatient.
BlackLaZoR@lemmy.world · 13 pts · 94d
They had a track record and found employment in government IT
HR should've been fired for that fuckup.
No. A case study against employing known criminals.
isVeryLoud@lemmy.ca · 2 pts · 92d
Both conclusions are correct, but step 1 was a background check
BlackLaZoR@lemmy.world · 2 pts · 92d
Don't know how it works in US, but in most of EU you're obligated to notify the employee about termination of work agreement like a month in adavnce. In case of IT revoking access that early would mean effectively month of paid leave.
isVeryLoud@lemmy.ca · 1 pts · 92d
Sounds nice.
BlackLaZoR@lemmy.world · 2 pts · 92d
That's why it doesn't happen
ApeNo1@lemmy.world · 13 pts · 96d
Redundant twin brothers to handle the redundant twin backups.
SocialMediaRefugee@lemmy.world · 10 pts · 95d
Commits hundreds of crimes then starts bringing up god. Class act.
skisnow@lemmy.ca · 4 pts · 95d
Call me sexist but that guy has really girly handwriting
SocialMediaRefugee@lemmy.world · 3 pts · 95d
Just needs to dot his "i"s with hearts.
IWW4@lemmy.zip · -2 pts · 96d