Bottom line: Missing technical security measures such as multi-factor authentication pose significant security risks and data breaches when executives deliberately block them for control purposes.
A CEO of a national service company with approximately 2,000 employees stored all usernames and passwords in plain text in an Excel spreadsheet on his desktop. Reason: He wanted to monitor employee email accounts and therefore also blocked multi-factor authentication.
Luke Irwin, CEO of Aegis Cybersecurity, reported to The Register a consulting case involving a company in the cleaning, security services, and industrial climbing sectors. The CEO maintained an Excel spreadsheet directly on his desktop containing the usernames and passwords of all employees in plain text.
The background was a security incident in which confidential information was accidentally sent via email to the entire workforce. The CEO then spent a night logging into each individual account and manually deleting the message. To exercise this control in the future, he refused to implement multi-factor authentication, as it would have blocked his direct access—despite the fact that the company had already been compromised by a ransomware attack.
The consultants were only able to move the CEO to delete the password list after approximately four months by demonstrating administrative alternatives to him: The IT team could remove emails centrally using simple administrative commands without requiring passwords. In parallel, however, the CEO refused to enable multi-factor authentication. Subsequently, there were two further data breaches in which sensitive customer data was stolen.
According to Irwin, the rejection of fundamental security measures is not an isolated case. He also advised a company in the medical sector that rejected MFA on the grounds that the additional confirmation steps would make access too complicated for external consultants. Following the end of the consulting engagement, data from that company was found on darknet marketplaces.
Source: www.it-daily.net · Published June 14, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.1.