US Customs supervisor stole CPUs/RAM from DHS PCs, sold on Newegg

Tue, 15 Sep 2026 15:32:56 +0000

Engineer — Skip
SOC/IR — Learn: A concrete insider-threat case involving hardware substitution that evaded detection — useful context for thinking about physical asset integrity controls and insider detection gaps, though no IOCs or detection rules apply here.
Leader — Learn: Illustrates insider-threat risk from privileged physical access; useful as a reference case when reviewing asset inventory controls or briefing leadership on insider-threat program gaps.

Physical-Security on CuraSec