A new employee’s first day should feel like a fresh start. For one fintech company, it became the way in. What began as a routine assumed compromise scenario ended with password cracking that exposed over 90% of employee passwords, including the CEO’s, all through a flaw in the company’s own onboarding process.
Not their financial technology. Not their security systems. Their onboarding process.
The setup
Our mission was straightforward: simulate an assumed compromise scenario, starting with nothing more than a standard employee laptop. What we found was anything but standard.
The company gave us user-level access: a predictable email format (first.lastname@domain) and an equally predictable temporary password, “TempPass”. New employees had to change that password on first login. That single, common security practice would prove to be their undoing.
The discovery
Using that pattern, we mapped potential usernames across the organisation. With over 300 accounts identified, we had a target list. Their Active Directory setup allowed only two password attempts every 15 minutes.
That limit looks secure on paper. Here’s why it wasn’t: at scale, it became our advantage.
Then we found the account that mattered: a newly created admin account, not yet activated. We used our knowledge of the onboarding process to get in. The keys to the kingdom were ours.
The breach
With elevated privileges, we extracted password hashes for every user in the organisation. Then came the password cracking. We ran the hashes against our 120GB+ hash database and cracked over 90% of the company’s passwords, from entry-level employees to the CEO.
We had compromised the very person who’d hired us to test their security.
The lesson
This breach proves a simple point: an organisation is only as strong as its weakest process. A routine onboarding procedure became the single point of failure for the entire company.
One small procedural gap exposed the business to a potential shutdown. Passwords were only the entry point. The consequence: once password cracking starts, it cascades through every account, every system, every executive login.
The call to action
Here’s the reality: we found this gap through one constant, targeted attack. A real adversary running the same password cracking playbook wouldn’t stop at 90%, and wouldn’t wait for permission. A few weeks of testing a year won’t close that gap.
The distance between perceived and actual cyber risk is often wide. This fintech believed their onboarding process was secure. They required a password change on first login, which looked like enough. Without continuous pressure-testing from every angle, that assumption went unchallenged for months.
The real lesson is about the processes nobody thinks to test: onboarding, offboarding, vendor access, the daily mechanics of running a fintech’s cyber security.
Don’t wait for a real attacker to find yours. Contact CovertSwarm and put your onboarding process, and everything else, under constant attack.