how it happened
- whoformer employeeleft the company
- the gapreporting accessstill worked after leaving
- the result8.2M customersbrokerage account data
what everyone assumed
Offboarding feels complete when the obvious things close: building, laptop, primary accounts. The unstated assumption is that ending employment ends reach. Access tied to a former role is presumed to lapse along with the role.
what happened
The reports the former employee could once pull were still reachable to them after departure. No alarm distinguished a legitimate prior download from one made by someone who no longer worked there, because the access had never been fully cut, only the employment had ended.
step by step
- an employee can pull internal reportsNormal access for their role.
- the employee leaves; the access does notEmployment ends, but the reach to the reports is never fully cut.the assumption breaks here
- the reports are downloaded after departureNothing tells a past legitimate download from this one.
- April 20228.2 million customers notifiedNames, brokerage account numbers and, for some, holdings.
how it surfaced
In April 2022 Block disclosed that a former employee had downloaded internal Cash App Investing reports after leaving. About 8.2 million current and former customers were notified; the reports held names, brokerage account numbers, and for some, holdings.
Ending employment and ending access are two separate acts, and only the first happens automatically.
The second is work somebody has to do, in every system the person ever touched.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersWeeks later, from home, they pull one more report.what it costs youYou now have to tell your customers their data left with a former employee.
- or it goes like thisit happenedColonial Pipeline, 2021howThe forgotten account's password turns up in a breach dump.what leavesa working way into the networkwho ends up with ita ransomware crew
- or it goes like thisit happenedCloudflare, 2023howA key or token set up for old work keeps working after everyone forgets it.what leavesinternal systems and documentswho ends up with itwhoever tries the key first
sources
- TechCrunch, 2022
- Block SEC 8-K, 2022
your turn
what you can do about it
this week
Take last quarter's leavers and check the reports and exports they used, one by one.
Someone left your company last quarter holding access to a reporting tool or a data export they used daily. Their primary account is closed. Whether that specific access closed with it is a different question, and the report they could pull is still there to be checked.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →