Description
Summary
A routine review of access logs showed that an administrator account of a former engineer had signed in to a customer's backup repository. The account should have been removed at the end of the engineer's contract. The first alert came in the morning, and after four hours of investigation we were sure that customer data had been reachable by someone who should not have had access. That moment is the awareness time.
Impact
The repository held backup sets with personal data of the customer's employees and clients. The logs show the account listed and opened two backup sets. We could not rule out that data was copied.
Response
The account was disabled within minutes, all repository credentials were rotated, and the access logs were secured for the investigation. The Incident Coordinator led a review of every other administrator account on customer repositories.
Notifications
The customer was told the same day. The report to the Dutch data protection authority followed two days after awareness, well within 72 hours, with the Data Protection Officer's help.
Root cause
The offboarding checklist did not list customer repositories, so the account stayed active after the engineer left.
Lessons learned
Offboarding now includes a check of every customer system, and a monthly report lists administrator accounts without a current employee behind them.