How a Cardinals executive hacked the Astros with an old reused password

The St. Louis Cardinals executive who broke into the Houston Astros' private scouting database did not need any hacking skills. He used a variation of a password a former colleague had used on his old Cardinals laptop.^[1] This case file covers how a reused password opened a rival's crown jewels, why a password reset did not lock him out, what it cost the man and the team, and the one control that was missing.

What happened

How they got in

Two ordinary habits did the work. First, the former colleague had apparently carried a close variation of an old password into his new job, and the person who had been handed that old password could guess the new one.^[1][2] Nobody forced a truly fresh password when he joined a new organization, and a password alone was enough to get in.

Second, the Astros' fix depended on email. The emergency reset sent new passwords to inboxes, and one of those inboxes was already open to the intruder. Changing the lock and mailing the new key to the same address the burglar was reading did not keep him out.^[3] Prosecutors said Correa also hid his identity, location and the type of device he used while logging in.^[2]

How it was caught

The Astros spotted attempts to get into the database in March 2014, and the case became a federal investigation.^[3][4] Correa's employment with the Cardinals ended in July 2015, and on January 8, 2016, he pleaded guilty in federal court in Houston to 5 counts of unauthorized access of a protected computer.^[1][2] Major League Baseball said its own inquiry, along with those by the FBI, the Justice Department and the Cardinals, found he acted alone.^[4]

What it cost

On July 18, 2016, a federal judge sentenced Correa to 46 months in prison, 2 years of supervised release and $279,038.65 in restitution. Prosecutors estimated the Astros' loss at about $1.7 million.^[1] The judge told him he had made life harder for the people whose work he took.^[1]

On January 30, 2017, baseball's commissioner ordered the Cardinals to pay the Astros $2 million and hand over their first 2 picks in that year's draft, numbers 56 and 75. Correa was placed on the league's permanently ineligible list.^[4][5] The commissioner held the club responsible for its employee's conduct even though the team had not authorized it.^[6]

The missing control

The missing control: a forced new, unique password plus multi-factor login. A new hire should never be able to reuse a close version of an old employer's password, and a password alone should never be enough to open email or a crown-jewel database.

With multi-factor login, knowing or guessing the password would have gotten Correa nowhere without the employee's phone or security key. The same safeguard would have protected the March 2014 reset, because a new password pulled from an email would still have needed that second step. And if new staff had to set fresh passwords that were checked against their old ones, the variation he guessed would not have existed in the first place.

What to do in your business

• Turn on multi-factor login for email first. Email is the key to every other reset, so protect it with an app prompt or security key for every user.
• Make new hires start clean. During onboarding, have new staff create brand-new passwords, ideally with a password manager, and tell them not to reuse anything from a previous job.
• Do not send new passwords by email. After a suspected breach, hand out temporary logins by phone or in person, force a change at first login, and require multi-factor at the same time.
• Collect and retire old credentials properly. When someone leaves, disable their accounts and never keep their passwords on file. No one should hold a departed employee's login.
• Watch for logins from odd places. Turn on alerts in your email and key systems for sign-ins from new devices, locations or anonymizing services.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.