Here is a breach story with a lesson that applies to almost every small business, even though it happened to a security company. CrowdSec, a firm that makes cybersecurity tools, revealed this month that attackers copied 170 of its private code repositories. The way in was not some exotic hack: a former employee still had access to the company's systems after leaving, that access was compromised, and the attackers walked in through it. The stolen code surfaced on a criminal forum months later. It is a textbook example of the risk hiding in almost every business: the accounts of people who have left.
What happened
The chain started with a poisoned software package (a supply-chain attack on a popular open-source project) that infected a developer's laptop and stole credentials. Normally that would be contained when the person leaves. But this developer had already departed CrowdSec, and his access had been kept on temporarily so he could finish some work. That lingering access, tied to a now-compromised machine, was enough: attackers used his retained GitHub token to copy 170 private repositories in about nine minutes. CrowdSec says only code was taken, not customer data, but the point stands.
Why this matters for a small business
Strip away that it was a security firm and this is one of the most common small-business exposures there is: accounts that outlive the people who owned them. The contractor who finished a project, the employee who left on good terms, the "we will clean it up later" login, each is a door left unlocked. Attackers love these because nobody is watching them, and because a departed person's access often still reaches real systems. It is exactly the risk we cover in offboarding and in closing accounts you no longer use, and it is almost always overlooked until it bites.
What to actually do
- Cut access the day someone leaves, not "eventually." If they genuinely need brief access to finish something, time-box it and remove it on a firm date, not an open-ended one.
- Keep a list of who has access to what, so you can actually remove it all when the time comes, hidden access you have forgotten cannot be revoked.
- Prefer least privilege and shared, revocable access over personal accounts and tokens that walk out the door with people.
- Review periodically. Every so often, check who still has access and prune anyone who should not.
The takeaway
If a company that builds security tools can be undone by a login that should have been switched off, any business can. The good news is that this is one of the cheapest risks to close: a firm offboarding habit and a clear picture of who can reach what. We help small businesses put exactly that in place, so the accounts of people who have moved on do not become the way in.