> After tricking a department representative into giving him a token code to access the portal, the hacker claimed he used the compromised credentials to log into the portal, where he gained access to an online virtual machine. From here, the cybercriminal was presented with three different computers to access, he said, one of which belonged to the person behind the compromised email account. The databases of DHS and FBI details were on the DOJ intranet, the hacker said.

With public facing sites like Amazon -- who have necessarily engineered and refined security solutions to manage a wide surface area of attack from its customer base -- getting successfully social engineered on occasion, I shudder to think what the situation is at a large, multidecade bureaucracy where internal-only legacy technology stacks and access control procedures have probably resulted in a mindset of "oh just put that on a sticky note" workarounds just to get work done.