An engineer locked 3,000 devices on their own employer's network: how to cut access when the IT admin or vendor at your Mexico site leaves

On October 6, 2026, BleepingComputer reported the sentencing of an engineer who, after a workplace dispute, locked more than 3,000 devices on their own employer’s network. The same day, The Hacker News reported that the FBI removed an Accenture contractor after an unapplied patch led to the ShinyHunters breach.

If you run a plant, warehouse or office in Mexico from abroad, both stories land close to home. Local IT is usually one person or one small vendor, several time zones from whoever signs off. Here is how to make sure the keys belong to the company.

Two headlines, one problem

Security people call it the bus factor: how many people have to disappear before the operation stops. At many Mexico sites of foreign companies the answer is one. The local technician knows the router, server and camera recorder passwords, often in Spanish-only notes headquarters has never seen.

In our experience the risk is rarely malice. It is that nobody at headquarters knows who holds which access, and when that person leaves, nobody revokes it.

Start with a privileged access inventory

Get on a call with your local IT person and fill in something like this:

System	If the wrong person controls it	Ask today
Windows domain	Locks PCs and resets everyone’s password	How many admins exist?
Firewall and router	Cuts internet, the VPN to HQ and cameras	Who holds the password?
Microsoft 365 or Google	Reads and deletes the site’s email	Is there an admin outside the local team?
Hikvision NVR	Wipes surveillance	Still on the factory password?
Hosting, domain and DNS	Takes down the site, redirects email	Who is the domain registered to?
Banking and SAT (e.firma)	Pays, invoices, receives tax notices	Who keeps the e.firma?

The SAT row matters more than it looks. The e.firma is the digital signature your Mexican entity uses with the tax authority. If it lives only on the local admin’s laptop, you have a problem.

Named accounts, MFA and a vault the company owns

Three rules solve half the problem.

Every administrator uses an account with their own name. No shared admin user split between three people and the vendor: when someone leaves, you cannot revoke them without resetting it for everyone.

Every privileged account gets MFA, the two-step verification with an app on a phone. That phone must be one the company can reach, not the technician’s personal one.

Passwords live in a company vault, an encrypted manager where management, ideally at headquarters, holds the master key. The technician gets access to the vault. The vault is not theirs.

The same-day offboarding checklist

When someone with access leaves, voluntarily or not, this happens the same day, not when headquarters wakes up:

1. Disable their domain and email accounts before the exit conversation.
2. Change every shared password they touched: firewall, NVR, hosting, Wi-Fi.
3. Revoke their MFA and remote access tools (VPN, TeamViewer, AnyDesk).
4. Review the apps they authorized in Microsoft 365 or Google Workspace; the guide is in auditing OAuth apps.
5. Collect the laptop, notify the bank and check who can sign at SAT.

Once a quarter, run the same list against the people who stay. You will find access from roles that changed long ago.

When the one leaving is your IT vendor

The Accenture contractor was not malicious; they were slow with a patch. That is why the contract with your Mexico vendor needs three clauses: every credential in the company’s name and handed over in writing at the end, a maximum window for critical patches, and an access audit on the way in and on the way out.

Mundo Ejecutivo wrote on October 5 that business continuity means protecting digital assets, not just the building. Access is the cheapest asset to protect and the most expensive to lose.

Let’s talk

And at your Mexico site?

If you cannot say today who has admin access to the firewall and email of your Mexico operation, it is nobody’s fault. There was never a process.

At ProcessBi every new client starts with an access audit: we document every privileged account, put it in the company’s name and store it in your vault, not in our technician’s head. The support plan with a written SLA puts everything on paper, including the patching window, and we report to headquarters in English.

Request your free access audit — we reply the same business day.