Internal whistleblower disclosures revealed systemic identity access management (IAM) failures within the WA Department of Communities. The agency failed to revoke active corporate credit card access and procurement tokens for numerous terminated ex-employees over multi-year periods.