'[Karen] got fired for her recklessness': Entitled employee refuses to follow password guidelines, company's emails get hacked, she pays the price

Author image for Ben Weiss
Ben Weiss • Writer and Editor
May 6, 2024 8:00 AM EDT

It's not easy for the Karens of the world to follow rules. They tend to operate according to their own flawed and delusional sense of reality and ethics. So when this Karen employee was told to follow a specific set of rules when setting up her new work email and she didn't like the fact that she couldn't name her password after her generic dog's name, she decided to do away with the rules entirely and do what she wanted instead.

Unfortunately for her, she would learn the consequences of those actions. Unfortunately for the company, their entire inbox of confidential information would be put at risk. That's because it did not take long for Karen's emails to be hacked. She tried to place blame on anyone else that she could, especially the IT worker who tried to walk her through the problem. He shared his side of the story via this thread on Reddit's r/MaliciousCompliance subreddit. 

Keep scrolling below for the fallout and for the subsequent update about what this Karen is up to now. For more stories like this, check out this post about a manager who disrespected a student worker's hours. 

Advertisement
  • 01
    "Karen and her (email) problems" + Compose tory Bookmarks Search mail ☐ C :
    via Stephen Phillips
  • 02
    Karen and her (email) problems XL OC This story was originally meant for r/TalesFromTechSupport but due to their rules, it wasn't allowed to be posted there. Its kind of a mix between revenge and a techsupport call. TLDR at bottom.
    via u/D0ublek1ll
  • 03
    A bit of background: I own a webhosting and msp company which I've setup 2 years ago with some friends with similar interest.
    via u/D0ublek1ll
  • 04
    We have a few serious clients but things have been sailing smoothly and quietly for some time, we're not a big company and we only spend a few hours a week doing actual work for it.
    via u/D0ublek1ll
  • 05
    So we have phone support, even though nobody is almost ever phisically at a desk when we get a call (we only get calls maybe twice a week). We pick up, walk to a pc or grab a laptop in the mean time.
    via u/D0ublek1ll
  • 06
    Sometimes it takes a minute after picking up the phone before we can actually help. Most of our clients know this and have no problem with it at all, we usually provide quick solutions and most of the time we do support for free.
    via u/D0ublek1ll
  • 07
    The actors: Me - obviously. Karen - Angry lady, client companies administrative person. She was just hired 2 weeks ago. Boss Client boss that I've had regular contact with.
    via u/D0ublek1ll
  • 08
    The story: Me: <insert standard corporate greeting> Karen: Hi, with Karen from <company>, I have issues sending email. Me: Im sorry to hear that, if you give me a second I'll walk to my desk so I can look into it.
    via u/D0ublek1ll
  • 09
    Now, its important to note that we know most contacts from the the bigger clients and are on a first name basis with most. Although we are not a big company we provide services tailored to our clients specific needs, as such we have regular conversations over e- mail discussing their services. This was the first time I spoke with Karen since she got hired recently.
    via u/D0ublek1ll
  • 10
    Karen: Why aren't you at your desk already? This is urgent and I need this sorted asap. We're not paying you for your time if you're slow and unhelpful. Me: screams internally already
    via u/D0ublek1ll
  • 11
    Me: Im sorry Karen, im just now arriving at my desk. I see you've been recently added to the mall system. Is this the first time you've tried sending an email from your..
    via u/D0ublek1ll
  • 12
    Karen: interrupts me No I've send many emails, probably more than you, I know how to send an email okay? Me: (possibly sounding a bit annoyed) I was going to ask is this is the first time you tried to send an email from your corporate email account.
    via u/D0ublek1ll
  • 13
    Karen: Yes, it is. Why? Me: Could you tell me what email client you're using? Karen: Im using <my companies webmail client>. Me: Alright, thats good. Did you get any error message that you can tell me?
    via u/D0ublek1ll
  • 14
    Karen: Yes, I don't know what it is and im not at my desk right now. Give me a minute to look it up. (Idk why she wouldn't stay at her desk after giving me earlier...) for it
    via u/D0ublek1ll
  • 15
    Karen: Okay so the error message is: <says her interpretation of the error without saying the actual error>. (The part where I jumped the and should've paid more attention)
    via u/D0ublek1ll
  • 16
    Me: It sounds like your inbox is full, your company has a 50GB shared mailbox limit, i can up the limit to 60GB for the rest of the month so you can continue to use the email system while you archive some old mails by printing physical copies or move them to your companies cloud storage.
    via u/D0ublek1ll
  • 17
    Karen: I dont want to archive my email. Me: alternatively Boss could order extra storage for email, it isn't that big of a change in cost. It should be well within the budget. Karen: I would rather archive my email then.
    via u/D0ublek1ll
  • 18
    (This is where finally my bell starts to ring and I decide to check on the usage report and sure enough disk usage spiked over the last 2 weeks or so, for HER mailbox only, so I decided to ask some questions to get better insights into what is really going on).
    via u/D0ublek1ll
  • 19
    Me: have you been getting any spam mails recently? Karen: Yes, a lot of these "non deliverable" have been popping up in my mailbox since I got hired. I was meaning to call for that too but I've just been soo busy that i just delete them, I delete about 250 of them every morning.
    via u/D0ublek1ll
  • 20
    (Note: our system caps the senders limit for email accounts to 250 a day to prevent our system from being used by spammers.. you may see where this is going).
    via u/D0ublek1ll
  • 21
    Me: Oh thats not good, and this has been going on since you where hired? Karen: Yes, its really annoying. Please do something about it. Me: I will look into it now, please stay on the line while i put you on hold.
    via u/D0ublek1ll
  • 22
    I dig up the SMTP log for her user account and sure enough, every day for the past 2 weeks or so at 00:00 250 emails are sent. Like clockwork, most of the sent emails return as non deliverable mail due to spam flags. Now, this is a mailbox that they use for their administration, meaning they get their invoices and appointments in there. She recently gained access rights to the mailbox which is when things started to go wrong.
    via u/D0ublek1ll
  • 23
    Me: Hi Karen, are you still on the line. Karen's phone: plays hold music In the mean time I start investing further, I change her password and gather everything I can find from our system regarding Karen administration mailbox and normal user mailbox.
    via u/D0ublek1ll
  • 24
    20 minutes pass without the holding music taking a break, it's really annoying so I hang up and call back.. Boss picks up. (This is where things start to go to ]. for Karen)
    via u/D0ublek1ll
  • 25
    Boss: <insert clients corporate greeting>. Me: <my corporate greeting>, I was just at the phone with Karen, I think her mailboxes might have been compromised for the past 2 weeks.
    via u/D0ublek1ll
  • 26
    Boss: Oh, thats interesting. Im with Karen right now, she has been in my office for the past 20 minutes telling me how you where re to her and that you refused to help her. And that we should find a different company for our IT needs.
    via u/D0ublek1ll
  • 27
    Me: Im sorry for any inconveniences that I may have caused, however, a hacked administration mailbox is a very pressing matter. I have spent the past half hour digging through logs and I've come to the conclusion that almost directly since Karen was hired spam started to be sent from the inbox. I think she might have used a weak password.
    via u/D0ublek1ll
  • 28
    Boss: alright, hold on.. Boss: returns from a 5 minute hold okay so I have asked Karen about this and she used <generic dog name> as her password. What does need to be done to take care of this issue?
    via u/D0ublek1ll
  • 29
    (We do enforce a default password policy for all accounts on our systems, our clients can disable this for email accounts by checking a box on the email account, since Karen is their companies administrator she was also tasked with creating and deleting email accounts for their collegues. She edited her own email account to allow for insecure passwords, her dogs name obviously didn't match the requirements and she thought it was unfair for another company to dictate what password she could use f
    via u/D0ublek1ll
  • 30
    Me: Well, I have spent the past half hour looking for information regarding this breach. It is evident that spam has been sent from <corporate domain>. I cannot find any evidence that the hackers accessed mail in the mailboxes, however, I cannot conclude that they didn't either.
    via u/D0ublek1ll
  • 31
    Boss: Sigh so you're saying they may have our entire administrative archive due to Karen's poor judgement calls for passwords?
    via u/D0ublek1ll
  • 32
    Me: That is basically what it boils down to, unfortunately there is no way to know this for sure. We don't log access to specific mails or folders. Only authentication attempts, sent mail and received mail. I have no way of knowing if they downloaded or looked at any of your mail. I would advice you to change all passwords of every account with every site and system you use. Just to be sure this doesn't result in any further breaches.
    via u/D0ublek1ll
  • 33
    Boss: That will take ages, ill task Karen and some others to start doing this directly. Me: Well we use a corporate password manager. This might be a nice solution for your company as well as it would allow for you and your colleagues to store passwords securely and give extensive permissions to who can see which passwords. It'll also allow you to easily keep track of all accounts that your company has, and since you don't have to memorize the passwords you can use different and very secure pass
    via u/D0ublek1ll
  • 34
    Boss: Yes, please. will you put an order in for me? I need this for all my employees. Me: Will do. Anything else I can help you with? Boss: Yes, I need some accounts terminated but I'll send them to you in a bit. Need to wrap things up here first.
    via u/D0ublek1ll
  • 35
    About 30 minutes later I received a termination request for all of Karen's accounts. She appearently heard what Boss said about her having to change all the company passwords and she refused. She was fired on the spot.
    via u/D0ublek1ll
  • 36
    TLDR: Angry Lady decides password policies are not important and uses extremely weak password on corporate accounts. Email box got hacked and possibly all of their mail archives was compromised. Tried to blame it on my company and got fired for her recklessness and lies.
    via u/D0ublek1ll
  • 37
    Edit: Switched from acronyms to names. Edit 2: Wow thanks so much for the platinum! Edit 3: Thanks so much for the gold and koalas!!!
    via u/D0ublek1ll
  • 38
    Update: I just now received a call on my personal cell from the boss (I believe I once gave it to him for a onsite job at his house back when I was just getting started). He thanked me for my directness and not actually trying to fight the claims of karen over the phone, as outgoing phonecalls are recorded from my clients side the recording was able to be used as evidence in support of her termination so she has no chance of trying to fight it and couldn't argue outside pressure caused her to ge
    via u/D0ublek1ll
  • 39
    I told him that I was happy to take care of all their business needs and hung up, feeling satisfied with my work for today.
    via u/D0ublek1ll
  • 40
    Update 2: So all this was posted yesterday on another sub. The events of the story happened yesterday.
    via u/D0ublek1ll
  • 41
    Today I spoke with some of the other office people from my client company, regarding the aftermath of their hacked mailbox. The boss of the company asked me to send an email to his entire company to explain the situation and what happened. Appearently I explained it so clearly to him he wanted me to adres his staff in the same manner. I wrote up an email explaining in laymens terms what happened and that it was totally preventable (and include tips for good passwords). I also told them that a pa
    via u/D0ublek1ll
  • 42
    In response to this email me and my collegues got several calls about what happened, they have a lot of work from home and on the road employees so there is a lot of office gossip that is delayed. Most of them specifically asked what happened to karen, as she sent a company wide email 2 weeks earlier introducing herself and telling everyone about her responsibilities and duties (I'm important, im basically your new boss, do as I say or get fired.). I didn't go into to much detail but I told them
    via u/D0ublek1ll

Want More? Follow Us and Add Us as a Preferred Source on Google.

Tags

karens workplace-stories work stories toxic-workplace job malicious compliance work karens in the wild entitled reddit thread Reddit karen entitled people toxic-work-environment
Scroll Down For The Next Article