A Security Engineer’s Mistake Led to a Ransomware Breach

Huntress recently disclosed a security incident in which one of its engineers stored recovery codes for a system account in plain text on a desktop, enabling attackers to steal them when the engineer’s system was compromised. Armed with these codes, the intruders were able to bypass MFA protections, breach the system and launch an attack against a customer environment, resulting in a data leak.

During the intrusion, the attackers exploited the company's corporate VPN service, SonicWall VPN, and in the process discovered a plain‑text file on a security engineer’s desktop containing the recovery codes. According to Huntress, the group behind the attack was identified as Akira, a cybercriminal syndicate specialising in data theft and ransomware deployment.

Initially, Huntress did not detect anomalies; to avoid discovery, the attackers marked security alerts as resolved, cancelled host isolations, and even initiated the uninstallation of Huntress agents, before customers noticed irregularities and raised questions. The incident underscores the guidance that recovery codes and sensitive credentials should never be stored in plain text or on a daily‑use PC, with analysts advising encrypted password managers or encrypted USB drives for secure retention.