Law firm insisted on one password to rule them all

This PWNED column describes a law firm that relied on a single master admin password which allowed staff to impersonate any user (staff or client) by supplying an email address, exposing sensitive client information including health records. The firm's IT employee refused to implement a backdoor, but management mitigated the issue by indiscriminately promoting all users to system admin rather than fixing authentication and access controls, leaving significant privacy and security risks despite no reported exploitation.