This is a very well written summary of how it all went down. From this, we can conclude: * An initial entry point through SQL injection (from which we can infe

This is a very well written summary of how it all went down. From this, we can conclude: * An initial entry point through SQL injection (from which we can infer that the federal site was probably never security tested) * The use and re-use of weak administrative passwords * The adoption of poor practices (such as sending passwords in cleartext via email) at rootkit.com Of all of these, the attack would've probably been limited to the federal site had Aaron used decent strength administrative passwords (or just not reused them). The issue regarding the website comes down to risk ownership. If Aaron Barr was the risk owner for the website, it falls down to him. If in his contracting the company, Aaron had a plan to test the website then whomever tested it missed the SQL injection (which could've been implemented after a test by the CMS firm without him knowing, or any number of things). If Aaron didn't have a plan to get the site checked out, then that's both strikes falling on his shoulders. The third strike is quite clearly stirring the hornets nest. Moral of the story: Don't antagonise groups that will strike back without a plan to deal with it. Moral #2: Don't reuse passwords. Moral #3: Retest your app on every significant change (including initial deployment).