Huge application. Dominating it’s industry. It had only one user on a DBs with a password that hadn’t been changed in over a decade. Same user/pass for each DB as well. The DBs were all publicly accessible. The applications, clients, engineers, and everyone else used that singular user.

At least one of those people seriously considered doing crime, right? It would be like shooting fish in a barrel and, with simple steps to hide your network origin, there would be no way of finding the culprit. With the kind of ransoms you could get from a company like that you could go and live happily ever after in Dubai.

Absolute madness.