But just as they thought they had identified the culprit, another surprising revelation emerged. One of their own, Sarah, a senior developer, had been using the same password for her personal accounts.