It’s hard to imagine a non-fraudulent scenario where anyone internal to the company would be asked to generate a list of realistic-looking customer names that w

It’s hard to imagine a non-fraudulent scenario where anyone internal to the company would be asked to generate a list of realistic-looking customer names that was 10X the size of your customer base. Even testing data doesn’t have a strict requirement of looking as realistic as possible. Intent matters in these cases. If the situation had somehow been adjusted so that the engineer genuinely believed the generation was for legitimate purposes, it would be very unlikely that they would be at risk from the initial list generation. However, I don’t really see how Director of Engineering could have not known the purpose, given that the ultimate goal was to load them into the production DB and the request was coming from outside of engineering.