Retailer Orvis.com Leaked Hundreds of Internal Passwords on Pastebin
Summary: Orvis, a Vermont-based retailer with about 1,700 employees, leaked hundreds of internal usernames and passwords on Pastebin.com, including plaintext credentials for firewalls, Cisco routers, Microsoft Active Directory, Oracle database servers, security cameras, and the combination to a safe in the company's server room. Hold Security found the file posted twice, on Oct. 4 and Oct. 22, while Orvis spokesperson Tucker Kimball said the file contained old credentials, many tied to decommissioned devices, and was removed after about a day.
What you should know: A single Pastebin post exposed the credentials to nearly every security product the company ran, and Hold Security's Alex Holden attributes the exposure to a trusted third party rather than Orvis staff - the same partner-access gap that sits in most organizations' environments today.
Read the original at Krebs on Security ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026