the screen that shows everything

Most companies guard production carefully and give the support team a screen that shows almost all of it. The support tool, the admin panel, the back office, whatever it is called in your company, exists so that someone can answer any customer question without asking an engineer. To do that it shows everything about a customer, and it often lets the person looking change the parts that matter most: the email address, the password, the second factor.

Three of the most instructive breaches of recent years went through that screen.

• Twitter, July 2020. According to the New York State Department of Financial Services, more than 1,000 employees had access to internal tools that could change an account’s email address, reset its password and turn two-step login on or off. Attackers phoned staff, posing as IT, and used the tools to take over 130 accounts. The full case is in the Twitter incident.
• Coinbase, 2025. In its filing of 15 May 2025 Coinbase said a criminal group had paid contractors or employees in support roles outside the US to collect data from internal systems they could reach for their jobs, including ID images, balances and transaction history. The full case is in the Coinbase incident.
• Discord, 2025. On 9 October 2025 Discord said ID photos of about 70,000 users had been exposed through an outside customer service provider’s access to its ticketing system. The vendor, 5CA, disputes how it happened. The full case is in the Discord incident.

In each case the systems worked as designed. The screen showed what it was built to show, to someone allowed to see it, and the danger came from who that someone was, or who was paying them.

three ways the support screen gets used

1. 1borrowedAn attacker signs in as an agent, after a phone call or a fake login page.
2. 2boughtAn agent is paid to photograph what the screen already shows.
3. 3outsourcedThe vendor's team has the same screen, under another company's controls.

why the support screen gets so wide

It is built for the hardest ticket. Someone once needed the full payment history to resolve a dispute, so the page shows payment history. Someone needed the identity document to unlock an account, so the documents are a click away. Each field was added for a good reason, and nothing was taken away.

It is given to everyone in the team. Support teams grow fast and turn over often. Splitting the tool into roles feels like overhead for a team of six, and by the time the team is forty nobody wants to be the one who slows it down.

Its most powerful buttons look like customer service. Changing an email address or removing a lost second factor is exactly what a locked-out customer asks for. It is also exactly what an attacker needs to take the account. At Twitter, NYDFS describes those as functions of the same tool.

It travels to vendors. Outsourced support gets the same screen, through the vendor’s laptops, the vendor’s hiring and the vendor’s login practices. The contractor guide covers how that access outlives the engagement. This guide covers what it can see while it is live.

Whoever opens the support tool sees what your best-informed employee sees.

what this looks like at your size

Picture a 200-person software company with a support team of twelve, four of them at an outsourcing partner. The back office shows each customer’s contacts, invoices, uploaded contracts and the integrations they have connected. Any agent can change the account owner’s email address, because customers ask for that every week. Nobody has looked at the list of people with access since the tool was built.

That company does not need a nation-state to have a bad week. One agent’s password reused on a breached site, one phone call from “IT”, or one agent offered money by a competitor is enough.

what narrows it

Split viewing from changing. Most agents need to read an account. Far fewer need to change who owns it. Put email changes, second-factor resets and ownership transfers behind a separate role, held by a short list of named people.

Put the account-takeover actions behind a second person. Changing a login email or removing a second factor is the step that hands the account to someone else. Require a second agent to approve it, or send a confirmation to the customer’s existing email and phone before it takes effect.

Hide what the common tickets do not need. Mask identity documents, full card details and bank data by default, with a button to reveal them that is logged and reviewed. Coinbase said its agents could see ID images and balances in their normal work, and that is what was photographed.

Delete attachments on a schedule. Support tickets collect ID scans, contracts and screenshots for years. Decide how long they stay, and delete the rest. Discord’s exposure came from photos users had sent to support.

Review who has the tool every quarter. Start with leavers, then people who have not used it for ninety days, then the vendor’s agents. Coinbase found its problem through monitoring of lookups with no business reason, and the cheaper first step is fewer people able to look.

the question to take to your team

If one support agent’s login were used by someone else for a weekend, which customer accounts could they take over, and would anyone notice before Monday?