An Iowa school district just learned what an unrevoked admin account costs: tens of thousands of dollars in damages, weeks of classroom disruption, and a 21-month federal prison sentence for the former IT employee who walked back in through the front door. He was not a foreign APT. He was a guy with a grudge and a password that nobody had bothered to rotate. That is the entire cybersecurity story for most organizations in 2026, and the same broken assumption shows up in this week’s npm announcement and the federal scramble around AI model access. Trust is being extended to identities and code paths that nobody is actively watching.

The case looks small on its face. One school district. One angry ex-employee. Some deleted accounts and disrupted classes. But the shape of it is the shape of nearly every intrusion we cover. Somebody had access. Somebody kept access. Nobody noticed until the damage was already done.

A Live Login Is A Backdoor With HR Paperwork

When the firewall blocks a connection, you write a report. When an offboarded employee logs in with valid credentials, your SIEM yawns. That asymmetry is the whole game. The Iowa attacker did not need a zero-day or a brute-force tool. He needed a session that should have died on his last day and didn’t.

This is the part of incident response that nobody puts on a slide. Identity hygiene is unglamorous, expensive, and constantly behind. Service accounts pile up. Shared admin credentials get whispered between sysadmins and never rotated. Break-glass accounts become daily-use accounts. Vendors get provisioned with full domain admin “just for the migration” and stay that way for three years.

The attacker received 21 months in federal prison for damage that any access review would have prevented. The control existed. Nobody ran it.

School districts are an easy target for this story because they run on shoestring IT budgets, but enterprises are not better. They are just better at hiding the mess. The 2024 Verizon DBIR put insider-caused incidents in the high double digits, and the median time to detect an authorized-account abuse case still sits in the months, not days. A former admin with current credentials is the highest-leverage attacker your organization will ever face, because every detection rule you have was written under the assumption that the login belongs to a real employee.

You cannot threat-model your way out of this with better firewalls or smarter EDR. The login is legitimate. The session is legitimate. The destruction is what tips you off, and by then you are doing forensics, not defense.

NPM Is Admitting Your Trust Extends Too Far

The other big story this week sits in the same conceptual bucket. npm 12 will stop executing install scripts from dependencies by default. You have to explicitly opt in. Read that twice. The largest package registry on Earth is changing its default because the implicit trust model finally collapsed under the weight of supply chain attacks.

The parallel to the school district case is not subtle. Every npm install on a developer workstation has been, by default, a remote code execution primitive granted to anyone who can land a package in your dependency tree. Nobody approved that grant. Nobody audited it. It just sat there, the same way that ex-employee’s admin account sat there, until the consequences arrived.

This is the unowned attack surface problem. Whether it is a dormant Active Directory account, a postinstall script in a transitive dependency, or, in the case of the US government’s order to Anthropic this week, model access granted to populations no one was tracking, the failure mode is the same. Trust got extended once and then forgotten. Security hardening has to start treating “we already gave them access” as a question worth re-asking every quarter.

npm’s change is good. It is also late by about a decade. The lesson is not “wait for vendors to fix their defaults.” The lesson is that the defaults you inherited are probably wrong, and the only person checking is you.

Do These Five Things This Week

Forget the maturity model. Forget the framework. Here is what you can actually do before Friday that addresses the threads above.

• Run an offboarding audit on the last 12 months of departures. Pull HR’s termination list. Cross-reference it against every identity provider, VPN, SaaS app, code repo, cloud console, and on-prem AD. Anyone with a session, key, or token after their last day gets killed today. If you find more than two, your offboarding process is broken and needs a written checklist with sign-off.
• Inventory and rotate every shared and service account. Especially the ones whose passwords are documented in a wiki page that three people have left the company knowing. Move them into a vault with checkout logging. If a credential cannot be rotated without breaking something, you have a documentation problem, not a security problem, and you need to fix it.
• Force npm install --ignore-scripts on CI runners and developer machines now. Do not wait for npm 12. Add it to your .npmrc. Same goes for pip --no-binary review and cargo install hygiene. Build-time code execution is initial access by any other name.
• Turn on alerts for login from a terminated account. Every IdP can do this. Most teams have never written the rule. The cost is one query and a Slack channel. The payoff is catching the next Iowa case in the first hour instead of the first quarter.
• Tabletop the “trusted insider with valid credentials” scenario. Most IR playbooks assume the attacker is external and the credentials are stolen. Walk through what your team would do if the SOC saw legitimate admin activity at 2am from a former employee. Who calls legal? Who locks the account? Who preserves the audit trail for the FBI? Iowa got a conviction because the evidence held up. Yours has to as well.

None of this requires a budget request. It requires an afternoon, a checklist, and the discipline to do the boring work. Threat detection on novel attacks is a noble pursuit. Threat detection on accounts that should not exist is table stakes, and it is where most defenders are still losing.

The Iowa case will be a footnote by next week. The pattern it represents is going to keep generating headlines until defense in depth means more than “we bought another product.” It means knowing who has the keys. It means taking the keys back when people leave. It means refusing to extend trust by default, whether that trust is going to a former colleague, a dependency you have never read, or a model endpoint you cannot fully audit.

Sources

• Ex-school district employee jailed for hacks on former employer
• NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks
• US Gov asks Anthropic to ban ‘foreign national’ access to Fable, Mythos