One misconfiguration reached every network user
DHS inspectors reported that all 76,000 Customs and Border Protection network users incorrectly had access to one highly privileged service account. The permissions could have allowed password, access and security-configuration changes.
The report also says all users had permission to perform privileged account functions. These are control exposures; the public report does not say all 76,000 users exercised the access or that a breach resulted.
| Population or sample | Finding |
|---|---|
| 76,000 network users | Access to one highly privileged service account |
| Sampled employee accounts | 20% disabled late |
| Identified contractor accounts | 15% disabled late |
| Transfers reviewed | 17% retained unneeded access |
Offboarding and transfers also failed
The audit found late disabling in 20% of sampled employee accounts and 15% of identified contractor accounts. It also found that 17% of transferred personnel retained access they no longer needed.
Those percentages come from different populations and should not be averaged. Together they show that access risk existed at creation, separation and internal transfer—not at a single point in the account lifecycle.
Eleven of twelve recommendations remain open
The inspector general made 12 recommendations. Oversight.gov lists 11 as open, meaning 91.7% remained unresolved at the public checkpoint and one had been closed.
Closure count is not the same as risk reduction: a recommendation can encompass multiple systems and actions. The meaningful follow-up is whether CBP removes excessive privilege, validates transfers and meets its account-disablement deadlines.
Method and limits
What’s the Scoop With Broach separated whole-network findings from sampled rates and calculated the share of open recommendations. The underlying findings and management responses are those of DHS OIG.
The report lists no questioned costs and does not establish data theft, sabotage or intentional misuse. Sample percentages should not be projected to all CBP accounts without the audit’s sampling design.
Sources and further reading
DHS OIG report OIG-26-28, September 4, 2026 ↗
CBP technology-support photograph and public-domain record ↗