Every Employee's Password Was Stored in a Single Excel File
The Register, Thursday, June 11th, 2026
A CEO kept all 2,000 staff passwords in an unsecured Excel file and refused MFA, despite prior ransomware.
The CEO of a 2,000-person facility services company kept a spreadsheet of every employee's login credentials on his desktop so he could access staff email accounts and delete messages he disliked. His justification stemmed from an incident where a colleague accidentally sent sensitive information company-wide, prompting him to delete it from all accounts manually.
Despite a security consultant's recommendations, he refused to enable MFA, viewing it as an inconvenience. He abandoned the practice only after being shown that IT admins could centrally remove messages without individual passwords. The firm later suffered two data breaches involving sensitive client information, underscoring the risks of poor access control.