According to a single source — security researcher Joe Brinkley, a former information system security officer for a government contractor — a firewall rule change in the early 2010s briefly opened a path to production servers holding 50 million immigration records. The developers wanted easier code deployment between a low-security test datacenter and the classified production datacenter. Brinkley opposed the change before the Change Review Board, but during his vacation the developers got approval from the Change Acceptance Board instead.
Brinkley later demonstrated the problem by tethering his laptop to his cell phone, logging into the dev server through the datacenter's VPN, and then reaching the production server from the same connection. The VPN was shared with thousands of other commercial tenants, including Microsoft and Oracle, though only dozens were supposed to access the classified network. The production server still required a password, but without multi-factor authentication and with weak password standards, brute-force or guessing was a realistic risk. Supervisors reverted the firewall rule immediately after the demonstration.
The article, published in The Register's PWNED column, does not include any other source. It notes that even with a VPN and password protection, sensitive data needs additional safeguards — a lesson that remains relevant for any organization relying on minimum-security configurations.