The leak included employee logins and passwords to various services, 44 million messages exchanged at work between different Disney departments, and some customer data.
The large-scale leak at Disney, as noted by The Wall Street Journalwas initiated by «an employee named Matthew Van Andel, who «simply wanted to download a free AI tool from GitHub», but instead «planted a spyware on»’s work laptop. For five months, the hacker obtained Andel’s personal data and internal Disney information through software containing malicious code with so-called keyloggers that allowed him to see every keystroke from an employee’s computer.
Andel himself discovered the problem when he received a message from a stranger on Discord with a link to a Slack work dialog and immediately contacted Disney’s information security department — but experts did not see it as a big threat, and realized their mistake only when the hacker published an archive of the company’s internal data of about 1 TB (with 44 million internal Disney messages, customer data, and employee income information) online.
Eventually, Disney fired Andel — allegedly after a forensic analysis revealed that he had been watching porn on his work PC (Andel himself denies this). The employee was also deprived of his health insurance and approximately $200,000 in bonuses, and his lawyer is now demanding eight-figure compensation from the company.
It should be noted that in the fall of the same year as the leak, Disney announced about its plans to stop using Slack for work-related emails and started the transition to new internal «streamlined tools for enterprise-wide collaboration».
Spelling error report
The following text will be sent to our editors: