Confronted by Rep. Rashida Tlaib, former SolarWinds CEO Kevin Thompson said the password issue was "a mistake that an intern made."
"They violated our password policies and they posted that password on an internal, on their own private Github account," Thompson said. "As soon as it was identified and brought to the attention of my security team, they took that down."
Neither Thompson nor Ramakrishna explained to lawmakers why the company's technology allowed for such passwords in the first place.
Ramakrishna later testified that the password had been in use as early as 2017.
"I believe that was a password that an intern used on one of his Github servers back in 2017," Ramakrishna told Porter, "which was reported to our security team and it was immediately removed."
That timeframe is considerably longer than what had been reported. The researcher who discovered the leaked password, Vinoth Kumar, previously told CNN that before the company corrected the issue in November 2019, the password had been accessible online since at least June 2018.
Emails between Kumar and SolarWinds showed that the leaked password allowed Kumar to log in and successfully deposit files on the company's server. Using that tactic, Kumar warned the company, any hacker could upload malicious programs to SolarWinds.