An admin left the company. Nobody could say what they could still access.
A Montana small business lost an employee who held admin access to finance, HR, banking, and cloud tools. We found every access point and locked it down.
A Montana small business whose former employee held administrative access across financial, HR, banking, and collaboration systems, plus a company cell phone.
Small Business
Incident Response, Digital Forensics, Access Revocation, Post-Incident Monitoring
When an employee left a Montana small business, the owners were left with a question they couldn't answer: who could still get into their systems? The former employee had held administrative access across finance, HR, banking, a company cell phone, and the business's collaboration tools, and there were already questions about how that access had been handled before they left.
This wasn't a password reset. The owners needed to know every place that access reached, shut all of it off, and find out whether anything had been mishandled along the way.
Before
The Challenge
Administrative access concentrated in one person is a risk while they're employed. After they leave, it becomes a bigger one. Every account that person controlled was a possible path to unauthorized access, financial misconduct, or exposure of employee and company data.
The business didn't have a full inventory of those accounts. Some access was known, like administrative logins to financial and HR systems. Other access could be hidden: forgotten accounts, saved sessions, or data sitting on physical devices.
The owners had four goals: regain full control of every critical account and service, be certain the former employee had no remaining access, find out whether access controls had been mishandled or were inadequate, and protect financial data, employee records, and proprietary documents from further risk.
After
The Results
The owners regained full control of their digital assets, with confirmation that the former employee had no remaining access to any company system.
The investigation identified specific weaknesses in how access had been managed, and the business was able to start fixing them right away.
Financial and sensitive data are now protected, with monitoring in place on the accounts that matter most.
The business also came away with a clear blueprint for managing access going forward, so the next departure doesn't raise the same questions.
The Solution
We responded immediately from our Great Falls office, starting with an urgent consultation to understand the owners' concerns, identify the systems in question, and set the scope of the investigation.
Our team then worked to identify every account and access point the former employee had, from known administrative logins to potential hidden entries across financial, HR, and cloud platforms. We also ran forensic analysis on the relevant physical devices to uncover local data, deleted data, and hidden access.
With that inventory in hand, we revoked access in priority order, starting with financial and administrative accounts. We reviewed logs and permissions across every account and device to confirm the lockout and look for unusual past activity, then ran integrity checks to make sure no backdoor access remained and every system was back under the owners' control.
After remediation, we put monitoring in place on critical accounts and network activity to catch any later attempts at malicious access. We closed with a detailed report covering our findings, confirmation of the lockout, the weaknesses we found in past access management, and recommended controls going forward.
One person held admin access to finance, HR, banking, and the company phone, and nobody could say for certain what they could still reach.
Something here raise a question about your own setup?
Thirty minutes, no slide deck. If you're in decent shape we'll tell you that.
Schedule a call