Repeatedly, they took whole directories of credentials, a brazen act netting them the ability to impersonate hundreds of employees.

And a determined, state-sponsored troll army would surely be able to impersonate hundreds of thousands of people and overcome basic identity checks.