Removed: nothing yet. The access had stood since 2019, and CBP concurred with all 12 recommendations rather than pointing to a fix already shipped.
Outcome: all 76,000 network users at US Customs and Border Protection had “inadvertently received unauthorized access to one powerful service account that would have allowed any user to perform privileged security tasks”.
DHS’s inspector general found the flaw was created in 2019 and went unnoticed until the auditors arrived. Offboarding leaked the same way: 72 of 365 sampled employees and 1,208 of 8,013 contractors were not disabled within the three days DHS requires, 623 contractor records were filed more than 30 days after the person had already left, and 615 of 3,697 transferred employees “retained unneeded access after transferring to a new position”.
A permission granted once and never looked at is the failure this case exists to record.
Source: DHS Office of Inspector General, OIG-26-28 (4 September 2026)