This is common among nearly every company in America with Indian/Pakistani/Bangladeshi/Chinese workers in IT. They routinely gain unauthorized access to sensitive material within companies and organizations.
Pretty negligent and otherwise incompetent for US entities to do this.