IT Guy Let Girlfriend Enter into Highly Restricted Server Rooms

A major security breach at Deutsche Bank’s New York datacenter has come to light through a lawsuit filed by a former Computacenter manager who claims he was wrongfully terminated after reporting unauthorized access incidents. James Papa, previously a service delivery manager at Computacenter, alleges he was fired in July 2023 after raising alarming security concerns […] The post IT Guy Let Girlfriend Enter into Highly Restricted Server Rooms appeared first on Cyber Security News.

May 7, 2025 - 12:53

IT Guy Let Girlfriend Enter into Highly Restricted Server Rooms

A major security breach at Deutsche Bank’s New York datacenter has come to light through a lawsuit filed by a former Computacenter manager who claims he was wrongfully terminated after reporting unauthorized access incidents.

James Papa, previously a service delivery manager at Computacenter, alleges he was fired in July 2023 after raising alarming security concerns about one of his subordinates who repeatedly allowed his Chinese girlfriend into highly secure server rooms.

The lawsuit, filed this Monday in New York, details how a Computacenter employee granted his girlfriend “Jenny” unauthorized access to Deutsche Bank’s server rooms housing the institution’s “big iron” – industry terminology for high-performance mainframe computers processing millions of sensitive financial transactions.

Breach of Physical Security

According to court documents, these security breaches occurred multiple times between March and June 2023, specifically on days when Papa was not on site.

This case is particularly concerning since CCTV evidence allegedly shows Deutsche Bank’s own security team allowed Jenny into the secure datacenter areas without proper credentials or authorization, violating fundamental datacenter security protocols.

Industry best practices mandate multi-layered security perimeters with strict physical and logical access controls, including biometric verification and continuous monitoring.

This represents a catastrophic failure of Deutsche Bank’s multi-layered security controls that should have prevented any unauthorized access to their critical infrastructure.

The Register reports that the security breach extended beyond physical access. Court documents reveal that Jenny, who reportedly has “significant computer expertise,” was also permitted to use her boyfriend’s laptop and access his work account while connected to Deutsche Bank’s network.

This potentially compromised the bank’s SIEM (Security Information and Event Management) systems, which are designed to detect and prevent such unauthorized access.

Computacenter operates Deutsche Bank’s computer systems as part of an IT services contract worth over $50 million. These systems contain millions of sensitive banking records and financial transactions for hundreds of thousands of customers.

After discovering these breaches, Papa claims he properly reported the incidents and advised management to disclose the security breach to the SEC, as required by regulations.

Instead of addressing these concerns, the lawsuit alleges Papa was subjected to aggressive interrogation by both companies.

“Each time Mr. Papa pointed out DB’s obvious and egregious security failures in allowing Jenny entry into headquarters, DB’s lawyer and DB’s security representatives at the meeting became agitated and even more aggressive in their behavior toward Mr. Papa,” according to court documents.

Following these confrontations, Papa was suspended and later fired.

His attorney, Christopher Brennan, told The Register: “He was basically being scapegoated; he said that no one was acknowledging it. This is Deutsche Bank security, they’re the ones who let this person in. Jenny’s not an employee of Computacenter, she doesn’t have any credentials, and yet they let her in”.

After his dismissal, Papa alleges he was informed that both companies had reviewed CCTV footage showing Jenny touching servers but had yet to determine her identity or intentions.

The lawsuit claims Papa was the only person disciplined despite the multiple security lapses. Papa is requesting more than $20 million in damages due to negligence and a violation of New York’s whistleblower protection laws.

As the legal process unfolds, the incident serves as a stark reminder for organizations globally: failing to address internal security lapses and responding against those who report them can have far-reaching consequences for operational integrity and corporate reputation.

Tax Scams Are Getting Smarter – Check Malicious Domains With Domain Research Suite

The post IT Guy Let Girlfriend Enter into Highly Restricted Server Rooms appeared first on Cyber Security News.