US contractor exposed path to 50M immigration records

A US government contractor changed a firewall rule, making a server with 50 million immigration records reachable from a less secure commercial datacenter. Thousands of people had access to that datacenter's VPN, and there was no multi-factor authentication.

• Firewall rule was changed despite the security officer's objections
• Server with 50M immigration records became reachable from a commercial datacenter
• Thousands used the datacenter VPN and MFA was absent
• The rule was reverted after the flaw was demonstrated