#offboarding
- Analysis · Oct 21, 2026SCIM in practice: provisioning rarely breaks on create, it breaks on leave
SCIM 2.0 is a decade old and the create path works almost everywhere. The failures that leave access behind sit in deactivation, group membership and PATCH, where RFC 7643 and 7644 leave room for two correct implementations to disagree. What breaks, why, and a test plan for the leaver path.
- News · Oct 20, 2026ICO reprimands Ogi and Data Cymru after a 12-year-old test account with Password1 let ransomware in
The UK ICO reprimanded Ogi Networks and Data Cymru on October 20 over a November 2024 ransomware attack that entered through a test account named Test2, created in 2012 with the password Password1, and exposed data on 3,300 people, mostly children.
- News · Sep 19, 2026CrowdSec kept a departing engineer's GitHub access open, and lost 170 private repositories through it
An engineer's laptop was infected in the May TanStack npm attack. Eleven days later his still-active GitHub OAuth token was used to copy about 170 of CrowdSec's private repositories. The company had left his access open so he could finish some work.