<story><title>Cardinals Face F.B.I. Inquiry in Hacking of Astros’ Network</title><url>http://www.nytimes.com/2015/06/17/sports/baseball/st-louis-cardinals-hack-astros-fbi.html</url><text></text></story><parent_chain><item><author>Fuxy</author><text>Wait does that mean they kept unhashed passwords? That&amp;#x27;s a big security no no and there&amp;#x27;s absolutely no reason they should have it like that.</text></item><item><author>timboslice</author><text>TL;DR: a member of the Cardinals&amp;#x27; staff left for the Astros a few years ago. Both teams had an internal system to track recruiting efforts etc. He used the SAME password in the new org, the Astros. Someone from the Cardinals org checked his master password list and was able to enter the Astros system with his old creds</text></item></parent_chain><comment><author>coleca</author><text>It&amp;#x27;s more likely that the Cards had a Excel file &amp;quot;Master_Passwords.xls&amp;quot; (or similar) with all his department&amp;#x27;s passwords listed in it on a shared department folder.  No encryption, hashing, etc.  Maybe they used Excel password protection on the file.&lt;p&gt;Just a hunch, but I&amp;#x27;ve seen it many times at past employers.</text></comment>
<story><title>Cardinals Face F.B.I. Inquiry in Hacking of Astros’ Network</title><url>http://www.nytimes.com/2015/06/17/sports/baseball/st-louis-cardinals-hack-astros-fbi.html</url><text></text></story><parent_chain><item><author>Fuxy</author><text>Wait does that mean they kept unhashed passwords? That&amp;#x27;s a big security no no and there&amp;#x27;s absolutely no reason they should have it like that.</text></item><item><author>timboslice</author><text>TL;DR: a member of the Cardinals&amp;#x27; staff left for the Astros a few years ago. Both teams had an internal system to track recruiting efforts etc. He used the SAME password in the new org, the Astros. Someone from the Cardinals org checked his master password list and was able to enter the Astros system with his old creds</text></item></parent_chain><comment><author>fname</author><text>I&amp;#x27;m guessing they mean they had a break-glass list of passwords for accounts to access those systems.</text></comment>