Chapter 5 - Melissa Had Access to Diane’s Username for an Ordinary Reason
The investigators initially assumed Melissa must have stolen login credentials too.
The explanation was embarrassingly mundane.
Three months earlier, Diane had trouble accessing an online foundation statement during a board retreat.
Melissa was sitting beside her.
Diane said:
“This damn site locks me out every time.”
Melissa helped.
Diane typed her password herself.
Then the browser asked whether to save the username.
Not password.
Username.
Diane clicked:
yes.
The laptop belonged to the club.
Shared boardroom device.
Bad practice.
The foundation’s IT consultant later found Diane’s username stored in the browser profile.
Anyone using that profile could see:
it.
Password?
Not stored.
How did someone obtain the password?
Possibility one:
Diane wrote it down.
She denied:
that.
Possibility two:
shoulder surfing.
Possible.
Possibility three:
password reset.
Bank logs showed none.
Then Melissa’s phone records.
No password note.
No obvious photograph.
No smoking gun.
Then Laura Chen, the finance director, remembered something.
During the board retreat, Diane joked about using her dog’s name in passwords.
Melissa heard.
Grant stared at his mother.
“You didn’t.”
Diane looked embarrassed.
“It wasn’t just the dog’s name.”
The investigator asked:
“What was it?”
Diane refused to say in front of Grant.
Later disclosed privately.
Dog name.
Birth year.
Symbol.
Guessable by someone who knew:
her.
That became part of Diane’s own accountability.
She had treated a serious banking credential like a family inconvenience.
Melissa may have exploited:
that.
But Diane had made exploitation easier.
The foundation changed every privileged credential immediately.
No shared browser profiles.
Mandatory password manager.
Hardware tokens stored in locked custody.
The security failure was not solely:
Melissa.
Systems had been casual because everyone trusted people they knew.
May you like
That was changing.
---
