If you have ever wondered why your company's data is not as secure as it should be, take a look in the mirror.

A study by the Ponemon Institute, commissioned by Experian and released in May, found that the majority of data breaches were not due to bad IT but due to bad employees who prey on unwitting or careless employees.

And it doesn't take a computer science degree to be able to do some major damage.

The latest "regular-guy" hacker to be sent to prison is Chris Correa, formerly of the St. Louis Cardinals ball club, for hacking into the Houston Astros' system. Last week, my colleagues Billy Hammel and Susan Bassford Wilson wrote about David Nosal, another regular-guy hacker.

The Astros and Nosal hacks were so low-tech that even I could pull them off. If I were that kind of person. Which I'm not. But anyway.

Astros Hack: "Ruh-roh, Reorge"

In Mr. Correa's case, two employees left the Cardinals organization to go to work for the Houston Astros. Before they left, Mr. Correa told them to turn in their Cardinals-issued laptops and give him their passwords. Very routine stuff with departing employees.

The former co-workers, "Victim A" and "Victim B," then went to the Astros. At the Astros, Victim A created a password that was very much like the one he'd used when he was with the Cardinals.

Mr. Correa was able to figure out Victim A's Astros password, since it was almost the same as his Cardinals password. Then Mr. Correa got into the Astros' reputedly awesome "Ground Control" system with Victim A's password and gained access to all kinds of confidential information, including scouting reports, rankings of ball players, and trade information and strategy.

Some of the Astros' information was posted on the internet in 2014, which got the FBI involved, which eventually resulted in Mr. Correa's being caught. But before that happened, the Astros changed the url for Ground Control and made everybody in the organization reset their passwords. The Astros sent an all-employee email with a temporary password (probably "Astros123" or something like that) that employees could use to get into the system and, once there, create a secure password.

Christopher Correa's plea deal is available here. The interesting stuff begins on page 7.

You guessed it. Mr. Correa got Victim A's email that had the temporary password. Then he was able use the temporary password to access Victim B's account and get even more confidential information from the Astros.

Crime doesn't pay, and Mr. Correa finally got caught and was prosecuted under the federal Computer Fraud and Abuse Act, the same law that got Mr. Nosal. Mr. Correa pled guilty and this week was sentenced to 46 months in prison.

Nosal Hack: Hell hath no fury like a Regional Director scorned

Then we have David Nosal's low-tech hacking. Mr. Nosal got mad at his employer because he didn't get a promotion he thought he deserved. So he decided to start a competing company of his own, and he recruited a couple of co-workers and his assistant to join him.

While the co-workers were still working for the former employer, Mr. Nosal had them go into the company system and get confidential and proprietary information that he could use in competition with his former employer. (In a 2012 decision, the U.S. Court of Appeals for the Ninth Circuit found that Mr. Nosal could not be prosecuted for aiding and abetting a violation of the CFAA for these "hacks" because the co-workers were authorized to use the company's system at that time.)

After the co-workers quit, the co-workers got Mr. Nosal's assistant -- who had stayed with the old company at Mr. Nosal's request -- to give them her password. Then they used her password to get access to more of the company's confidential information.

On July 5, a three-judge panel of the Ninth Circuit upheld Mr. Nosal's conviction for conspiracy to violate the CFAA based on the co-workers' hacks using the assistant's password. This time, the Court said, there were CFAA violations because the co-workers were not authorized to use the assistant's password.

How employers can prevent "head-slap hacks"

Both of these cases are good reminders that sometimes the simplest things can cause major data breaches and major damage to employers. Hackers can hack without necessarily having any kind of specialized IT background. And simple ignorance or negligence can allow these hacks to occur.

Speaking of ignorance, there's this. Head slap to the nth power!

A hack prevented is better than a hack prosecuted after the damage is done. Although there may not be much you can do to stop a dishonest or vindictive employee (but check with your IT people to be sure), there is a lot that you can do to raise awareness and prevent your honest employees from becoming unwitting tools.

Based on what happened to the Astros, employers might want to affirmatively require new hires to choose a truly unique password and prohibit them from "recycling" the password that they used on their previous job. And be sure to promptly terminate access to the system when an employee quits or is terminated, which I think most employers are already good about doing.

Employee cybersecurity training is also a good idea. The Ponemon Institute study recommends that the training include practical information, presented in interactive ways, about real-world cybersecurity problems that, unfortunately, we all encounter just about every day. For example,

*Phishing: Sending a legitimate-looking email that encourages recipients to disclose financial information, or access to credit card or bank accounts. ("There is a problem with your account. Please click here to verify your information.")

*Spear phishing: Same as phishing, except that the bad email is directed toward a specific individual. ("Dear John: There is a problem with your American Express credit card. Please use this link to log in to your account and to verify that this charge was authorized by you.")

"Social engineering":  This is really scary. An attacker pretends to be someone the recipient should know and as a result obtains sensitive information or access. ("Hi. I'm the new HR assistant, and I've been asked to update our records for our next Affirmative Action Plan. Can you please send me a spreadsheet listing everyone in your department, including name, race, ethnicity, gender, date of birth, job title, home address, home phone, date of hire, and SSN? Thanks a bunch! I look forward to working with you!")

and also

*Secure use of mobile devices.

*Secure use of "cloud" services.

The Institute also recommends that data security training be mandatory, and that employees at all levels in the company be required to participate (including the IT Department and the CEO), as well as contract and contingent workers.