# A former office manager kept signing in to her old company's website after she resigned (2015–2016) and what it shows about passwords other people know

An office manager with access to coworkers' logins resigned in 2015, then signed in to her old company's website into 2016, at times with a coworker's login.

Updated: October 16, 2026

An office manager at a company in Texas helped new employees set up their accounts on the company's password-protected website. Her job gave her access to their logins. She resigned around January 2015 and started working for a competitor. She kept signing in to that website until at least July 2016. At times she used a coworker's login, without the coworker knowing. She pleaded guilty in March 2017 to accessing a protected computer without authorization.

## What happened

The facts below come from the US Attorney's press release on her guilty plea.

She worked for the company for four years. As office manager, she helped new employees create accounts on the company's website and had access to their login details.

Around January 2015 she resigned and started working for a competitor. After that, she repeatedly accessed the company's password-protected website without authorization. She got confidential information on pricing and client orders.

She also signed in to the website with a coworker's login, without the coworker knowing or agreeing. In her plea, she admitted doing this about 20 times in 2016.

On May 31, 2016, one of those times, she used that login to open the company's client list. She sorted it by location and by purchase size, and downloaded it. She then combined it with her new employer's customer data. According to her, the new employer used the combined list to send promotional materials to at least 1,300 of the company's clients.

She kept accessing the website until at least July 2016, about 18 months after she resigned. According to information presented in court, the loss was about $275,810.

## The cause stated in the record

The record sets out two facts side by side. As office manager she had access to other employees' login details, and after resigning she signed in with one employee's login. It doesn't say whether that login was one she had helped set up. Resigning ended the job, but that login still worked.

For her other visits, the record says only that she accessed the site without authorization. It doesn't say whose login she used, or whether her own was ever turned off. It also doesn't say whether the coworker's password was ever changed. Signing in after your permission ends is the conduct described in [what is unauthorized access under the CFAA?](/guides/incidents/what-is-unauthorized-access-cfaa)

## Controls usually expected after incidents like this

The record shows a way back in that doesn't depend on the person's own login. Turning off a departing person's own login is one step. Changing the passwords of other people's logins they may know is a second.

The CERT Common Sense Guide to Mitigating Insider Threats, from Carnegie Mellon's Software Engineering Institute, covers this as guidance, not law. Its Best Practice 10 names passwords that coworkers "openly shared" as one way insiders get into other people's accounts. It says to use shared accounts "only when absolutely necessary."

The same practice asks for controls that let auditors and investigators trace all activity on an account to one person. It also asks staff to report any suspected attempt to get into their accounts. In this case, the employee whose login she used didn't know about it.

Its termination checklist (Best Practice 20) includes changing all shared account passwords when a privileged user leaves. An office manager with access to other employees' logins holds the same kind of knowledge. What it takes to repeat that change at every departure is covered in [the limits of changing shared passwords every time someone leaves](/guides/shared-accounts/password-change-on-every-departure).

Best Practice 20 also says to review a departing person's activity for at least 30 days before and after they leave, or 90 days if the data is available. The record dates the visits with the coworker's login to 2016, more than a year after she resigned, so a review limited to that window would not have reached them.

## Questions to ask about your own setup

- Who in your company sees other people's passwords as part of the job, such as an office manager, a front desk lead or whoever sets up new hires?
- When that person leaves, which passwords change, and who checks?
- Does each person sign in to your web tools under their own login, or do some share one?
- When someone leaves, do you change the passwords of shared logins they knew, and tell everyone who stays?
- Would you notice a current employee's login being used by someone else?


## Frequently asked questions

**Is it a crime to sign in with a former coworker's password?**

It can be. The former office manager in this case pleaded guilty to accessing a protected computer without authorization, under the federal anti-hacking law, 18 U.S.C. 1030.

**If we turn off a person's own login, are we done?**

Not if they know other passwords. In this case, the former office manager also signed in with a coworker's login that still worked.

## Sources

- [18 U.S.C. 1030, Fraud and related activity in connection with computers (govinfo, United States Code 2023 edition)](https://www.govinfo.gov/content/pkg/USCODE-2023-title18/html/USCODE-2023-title18-partI-chap47-sec1030.htm)
- [SEI CERT National Insider Threat Center, Common Sense Guide to Mitigating Insider Threats, Seventh Edition (2022)](https://www.sei.cmu.edu/documents/619/2022_019_001_886876.pdf)

## How Junify handles this

**Doing this by hand** To avoid the same kind of incident, you stop every login a person could use each time they leave or a contract ends. You change the shared passwords they knew and send the new ones to everyone who stays. And someone has to check the sign-in records on a regular schedule.

**With Junify** In the Texas case, the way back in was a web login and a coworker's password she could still use. With Junify, staff sign in to the company's web apps through Junify. They verify on their own phone, and Junify fills in the login without showing them the password. When the admin removes a person's access in Junify, their way in through Junify ends.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=shared-accounts&from=guide&cluster=incidents&slug=former-staff-login-after-leaving)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [A vendor's stolen login opened a retailer's network (2013) and what it shows about vendor remote access](/guides/incidents/contractor-pc-malware-shared-auth): A Senate staff report says attackers stole a contractor's login through infected email and used it to enter a national retailer's network.
- [Vendor call-center staff opened 68,701 customer accounts without authorization (2014) and what it shows about reviewing vendor access](/guides/incidents/contractor-sent-data-outside): For 168 days, three workers at a carrier's call-center vendor opened 68,701 customer accounts without authorization and collected personal details.
- [A former contractor used a shared cloud admin key (2018) and what it shows about shared admin logins](/guides/incidents/contractor-shared-admin-account): An online education company shared one full-access cloud key with staff and contractors. A former contractor used it to take data on about 40 million users.