[fierro]

>The one service token and three accounts were not rotated because mistakenly it was believed they were unused.

This odd to me - unused credentials should probably be deleted, not rotated.

[pbhjpbhj]

This smells weird, surely? I'd be looking at who chose not to rotate those particular credentials.

1: "what are these accounts?"

2: "oh they're unused, they don't even appear in the logs"

1: "we should rotate them"

2: "no, let's keep those rando accounts with the old credentials, the ones we think might be compromised ... y' know, for reasons"

?

[pphysch]

More likely: "no one has any idea what these old credentials do, so let's not touch them and potentially break everything"

[mparnisari]

Agreed. This whole post reads as "I'm the victim" but they don't admit on the one mistake that snowballed