Announcing that they're so incompetent that they failed to revoke a former employee's credentials is pretty dense. Talking to lawyers is the right thing to do.

Announcing that they're so incompetent that they failed to revoke a former employee's credentials is pretty dense. Talking to lawyers is the right thing to do. You don't want this gossip to become a legal issue for you. Collect detailed notes on when and where you turned in hardware, when / what credentials you had revoked, and to whom you delivered these things and informed about them. Just because you didn't perpetrate the hack doesn't mean that someone else wasn't using your hardware for something nefarious. I normally insist that a work laptop be wiped (obviously with all relevant work product handed off first) before i turn it in.