First of all, if you haven’t read it, you must: The FBI is investigating baseball’s St. Louis Cardinals for hacking the Houston Astros, according to the New York Times. Someone from the Cardinals allegedly stole data offering insight into the Astros player evaluation files, details on possible trades, and so on. This kind of corporate espionage goes on all the time, and if you didn’t believe that, well, there you are.
Here’s what’s interesting for you. The story-in-the-story here is that the Astros hired a hot-shot Cardinals employee named Jeff Luhnow and made him general manager. He took some Cardinals employees with him. That created bad blood. Apparently, it also created a beachhead for the hacker. The Times reported today that someone from the Cardinals used old passwords from those former employees when breaking into the Astros’ computers.
“Investigators believe Cardinals officials, concerned that Mr. Luhnow had taken their idea and proprietary baseball information to the Astros, examined a master list of passwords used by Mr. Luhnow and the other officials who had joined the Astros when they worked for the Cardinals. The Cardinals officials are believed to have used those passwords to gain access to the Astros’ network, law enforcement officials said,” the Times says.
In other words, Cardinals employees re-used passwords they had used when they worked for the Astros. Let that be a lesson to you: When you switch jobs, switch whatever password creation trick you have been using.
Still, the situation is a bit unusual. Computer networks are designed so such passwords cannot be retrieved, even by system administrators. They’re encrypted. Even firms that store previous passwords to prevent re-use scramble them so they can’t be accessed, according to security expert Harri Hursti. At least, that’s “best practice.”
On the other hand, “there are a lot of crazy organizations out there that store passwords in clear text,” Hursti said.
There are other possibilities, of course. That details in the New York Times story could be wrong. A former Cardinals employee could have shared his or her password with others in the team’s front office — that’s not unusual. Maybe a post-it note was left behind on a computer monitor. Maybe the password was “password.”
But here’s your nearly daily reminder that you might be hacked, and the hacker might be a surprise — it might be a former friend or colleague. So be vigilant about your passwords. And when you change companies, change your password habits.
