A fired school IT worker used over 300 saved passwords against his old district (2023–2025) and what it shows about passwords that leave with people

An IT staff member at a public school district in the Midwest was fired in April 2023. Before he left, he downloaded over 300 usernames and passwords for district accounts and programs. From June 2023 he used them to get into, or try to get into, the district’s online accounts and applications. In January 2025 a series of these attacks suspended classes for hours. A federal court sentenced him for computer fraud and ordered restitution to the district and its insurer.

What happened

The facts below come from two press releases by the US Attorney’s Office: one on the charge and one on the sentencing.

He worked in the district’s IT department until he was fired in April 2023. Before the firing, he downloaded over 300 usernames and passwords for district accounts and programs. The releases don’t say how he downloaded them or where the list had been kept.

Over the next year and a half, he used that list to get into, or try to get into, district online accounts and applications. The first attack came in June 2023, when he took down one of the district’s social media pages. After that, he tried to revoke district employees’ access to critical systems. He also tried to delete district accounts and information.

When those attempts worked, they caused technology outages across the district. District employees then had to spend significant effort repairing the damage. The attacks peaked in January 2025, with a series of attacks on district applications that suspended classes for hours.

The court ordered him to pay restitution to the district and its insurer. For what federal law treats as unauthorized access, see what is unauthorized access under the CFAA?

The cause the record states

The record states one path. The usernames and passwords were copied before the firing, left the district with him, and still let him in afterward. A copied password keeps working until someone changes it, whether or not the person’s own account has been turned off.

The record leaves several things open. It doesn’t say whose accounts the passwords belonged to, or whether any were shared. It doesn’t say whether the district changed any of them after he left. It says he got into or tried to get into the accounts, so not every attempt worked.

CISA defines an insider as anyone who “has or had” authorized access to an organization’s resources, which includes former staff. CISA calls deliberate actions to harm an organization’s systems sabotage. Because this is a criminal case, the record lists no corrective steps by the district.

Controls usually expected after incidents like this

Two pieces of federal guidance cover this path.

CISA’s Cybersecurity Performance Goals include goal 3.D, Revoking Credentials for Departing Staff. Its stated outcome: “Prevent unauthorized access to organizational accounts or resources by former staff.” It asks for a defined, enforced offboarding process that includes “the revocation of all access to systems and facilities.” It applies to contractors and vendors as well as employees.

NIST SP 800-53 Revision 5 lists the same work as parts of control AC-2, Account Management. Part h asks that account managers be told within a set time when users are terminated or transferred. Part l asks that account management line up with your termination and transfer process.

Part k covers passwords other people know. It reads: “Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group.” An authenticator here is the password or other secret used to sign in. NIST gives the reason: so that “former group members do not retain access to the shared or group account.”

For an IT role, that group can be large. A person who sets up and fixes accounts for others may see, or be able to export, passwords for many systems. So their offboarding needs more than turning off their own login. It needs a list of every password they could see, and a person assigned to change each one.

Part g of the same control asks you to monitor the use of accounts. In this case the attempts ran from June 2023 into January 2025. A record of who signed in to each account, and when, is what lets you spot attempts like these after someone leaves.

For the full list of logins to close at departure, see the onboarding and offboarding checklist. If your passwords sit in a shared password manager, see what to change when someone leaves a shared password manager.

Questions to ask about your own setup