Fired on Wednesday, deleting files on Friday: the credit union access that never got cut

Someone at a New York credit union asked for a fired employee's remote access to be shut off. It was not, and 2 days later she logged back in and spent about 40 minutes deleting more than 20,000 files.^[1][2] This case file covers what happened, how an unfinished offboarding task turned into a federal case, and the one control that would have made it a non-event.

What happened

How it worked

There was no hacking in the usual sense. Nothing was broken into, no password was guessed and no one was tricked. A former employee used the same remote login she had used the week before, and the server treated her as a trusted member of staff because, as far as its settings knew, she still was one.^[2][5]

The weak point sat in the handoff between people. The request to cut her off went from the credit union to its IT provider, and then nothing confirmed that it had actually been done.^[3][5] Small organizations that outsource IT often depend on exactly this kind of email or phone request, with no ticket number, deadline or check that the account is really dead.

Her account also appears to have had broad rights over the shared drive. A part-time employee could delete thousands of folders, including one that protected the organization against ransomware, in a single short session.^[2][4]

What it cost

Some of the data had backups, which limited the damage, but the credit union still spent more than $10,000 on remediation.^[1][4] The trade press later identified the credit union, but it was the victim here and is not named on this page.

Barile was charged in federal court in Brooklyn with one count of computer intrusion and pleaded guilty in late August 2021. The charge carried up to 10 years in prison.^[1][4] She was later sentenced to probation, according to a January 2023 trade press report.^[6] The texts to her friend, which were cited in the charging papers, left little room for any other explanation.^[3]

The missing control

The missing control: disabling access at the moment of termination, and confirming it was done. The request existed. What was missing was a process that made cutting off access happen at the same time as the firing, with someone checking the result.

If the remote login had been switched off on May 19, or even the next morning, the Friday session could not have happened. A simple follow-up the same day, trying the account or asking the IT firm for written confirmation, would have caught the miss with 2 days to spare. Tighter file permissions, so a part-time role could not wipe shared folders, would have shrunk what 40 minutes could do.^[2][3]

What to do in your business

• Cut access before or during the termination meeting. Disable email, remote access, shared drives and any cloud apps while the conversation is happening, not afterward.
• Keep a one-page offboarding checklist. List every system each role can reach, and tick each one off with a name and time when access is removed.
• Get written confirmation from your IT provider. If someone outside does the work, ask for a reply that says the account is disabled, then test it yourself by trying to sign in.
• Limit who can delete in shared folders. Most staff need to read and add files, not erase whole directories. Save delete rights for the few who need them.
• Test a restore. Pick a folder, restore it from backup, and time it. Know that you can get data back before the day you need to.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.