FORMER IT

@wassimcti

29.4K followers · usually 16.6K views a post

Views

48.5K

Likes

2.9K

Comments

79

Shares

191

Selling · Other Product

—

Why it worked

The video tells a compelling story of a cybersecurity breach with a clear narrative arc, highlighting the consequences of insider threats and the methods used by hackers. The use of on-screen text and clear, concise explanations makes complex information accessible to a broad audience, while the "follow for more" CTA encourages engagement.

Summary

A former IT specialist for the Saydel School District, Ezekiel Potter, was sentenced to 21 months in prison for hacking into the district's systems. After his employment ended, he used his retained admin credentials to delete the school's Facebook page, wipe user accounts and billing info from Apple devices, and delete nine Gmail accounts, including those of the IT director and superintendent. His actions were eventually traced, and he pleaded guilty.

Structure

1Introduction of Ezekiel Potter and his crime
2Details of his hacking activities (Facebook, Apple devices, Google admin, Schoology)
3Consequences of his actions (teachers locked out, IT employees profiles deleted)
4Discovery and investigation by authorities
5The USB drive with credentials leading to his arrest
6His plea and sentencing

Product placement

Original caption

A former school district IT guy spent 18 months wrecking school systems with credentials nobody revoked when he left. He got 21 months in prison. #cybersecurity #insiderthreat #hacking #accessmanagement #infosec

More from @wassimcti

Their other posts in the index, biggest breakout first.

Facebook: It is the school district's Facebook page that was deleted. Removing it would change what happens in the video. It acts. Saydel School District: This is the school district that was hacked. Removing it would change what happens in the video. It is the victim. Apple: This is the company whose devices were used in the hack and who was contacted to fix the issue. Removing it would change what happens in the video. It acts. Schoology: This is a learning platform that was accessed by the hacker. Removing it would change what happens in the video. It acts. Google: This is the platform through which the hacker accessed the admin account. Removing it would change what happens in the video. It acts.

Call to action

FOLLOW FOR MORE CYBERCRIME NEWS

On-screen text

FORMER IT JUST GOT 21 MONTHS IN PRISON FOR HACKING A USING THE SAME ADMIN CREDENTIALS NOBODY TOOK AWAY FROM HIM WHEN HE HIS NAME IS EZEKIEL POTTER A SENIOR SUPPORT SPECIALIST FOR THE SAYDEL SCHOOL DISTRICT IN DES MOINES FROM 2022 TO 2023 EMPLOYMENT ENDED HE KEPT HIS ADMIN CREDENTIALS USE THEM OVER AND OVER AGAIN 18 MONTHS FIRST HE DELETED THE SCHOOL DISTRICT'S facebook PAGE THEN HE WENT AFTER THEIR APPLE SCHOOL MANAGER ACCOUNT WIPE USER ACCOUNTS BILLING INFO PHONE NUMBERS AND DEVICE MANAGEMENT DATA OUT OF EVERY DISTRICT MACBOOK AND IPAD FOR WHILE THEY WORKED WITH APPLE TO FIX IT JANUARY 2025 HE GOT INTO THE schoology LEARNING PLATFORM THROUGH A GOOGLE ADMIN ACCOUNT IT EMPLOYEES WHICH KICKED TEACHERS OUT OF THEIR CLASSES FOR TWO A WEEK LATER HE WENT BACK IN AND DELETED NINE GMAIL ACCOUNTS INCLUDING THE IT DIRECTOR'S ACCOUNT AND THE SUPERINTENDENT'S ACCOUNT GOOGLE EVENTUALLY FLAGGED THESE LOGINS AS SO POTTER SWITCHED TO A VPN TO COVER HIS BUT INVESTIGATORS ALREADY TRACED HIS PREVIOUS ACTIVITY BACK TO ADDRESSES FROM HIS OTHER EMPLOYERS AFTER LEAVING ONE OF THOSE JOBS ASKED THE FORMER CO-WORKER TO GRAB A DRIVE OFF OF HIS OLD DESK AND WIPE IT WENT STRAIGHT TO THE FBI AND GAVE THEM THE USB DEVICE ON THAT U THERE WAS SPREADSHEETS OF USERNAMES AND PASSWORDS FOR THE SCHOOL DISTRICT HE PLED GUILTY BACK IN JANUARY 2026 GET A PLEA DEAL FOLLOW FOR MORE CYBERCRIME NEWS

Transcript

FORMER IT JUST GOT 21 MONTHS IN PRISON FOR HACKING A USING THE SAME ADMIN CREDENTIALS NOBODY TOOK AWAY FROM HIM WHEN HE LEFT. HIS NAME IS EZEKIEL POTTER. HE WORKED AS A SENIOR SUPPORT SPECIALIST FOR THE SAYDEL SCHOOL DISTRICT IN DES MOINES FROM 2022 TO 2023. BUT WHEN HIS EMPLOYMENT ENDED HE KEPT HIS ADMIN CREDENTIALS AND USED THEM OVER AND OVER AGAIN FOR THE NEXT 18 MONTHS. FIRST HE DELETED THE SCHOOL DISTRICT'S FACEBOOK PAGE. THEN HE WENT AFTER THEIR APPLE SCHOOL MANAGER ACCOUNT TO WIPE USER ACCOUNTS, BILLING INFO, PHONE NUMBERS AND DEVICE MANAGEMENT DATA OUT OF EVERY DISTRICT MACBOOK AND IPAD FOR WHILE THEY WORKED WITH APPLE TO FIX IT. IN JANUARY 2025 HE GOT INTO THE SCHOOLOGY LEARNING PLATFORM THROUGH A GOOGLE ADMIN ACCOUNT AND DELETED ALL IT EMPLOYEES WHICH KICKED TEACHERS OUT OF THEIR CLASSES FOR TWO HOURS. A WEEK LATER HE WENT BACK IN AND DELETED NINE GMAIL ACCOUNTS INCLUDING THE IT DIRECTOR'S ACCOUNT AND THE SUPERINTENDENT'S ACCOUNT. GOOGLE EVENTUALLY FLAGGED THESE LOGINS AS SUSPICIOUS SO POTTER SWITCHED TO A VPN TO COVER HIS TRACKS BUT INVESTIGATORS ALREADY TRACED HIS PREVIOUS ACTIVITY BACK TO IP ADDRESSES FROM HIS OTHER EMPLOYERS. AFTER LEAVING ONE OF THOSE JOBS HE ASKED THE FORMER CO-WORKER TO GRAB A USB DRIVE OFF OF HIS OLD DESK AND WIPE IT. THAT CO-WORKER WENT STRAIGHT TO THE FBI AND GAVE THEM THE USB DEVICE. ON THAT USB THERE WAS SPREADSHEETS OF USERNAMES AND PASSWORDS FOR THE SCHOOL DISTRICT. HE PLED GUILTY BACK IN JANUARY 2026 AND DIDN'T GET A PLEA DEAL. FOLLOW FOR MORE CYBERCRIME NEWS