hacker pilfered sensitive Twitter business documents and released them publicly. Twitter co-founder Biz Stone said in a statement that the hacker got in by figuring out the log-on of a Twitter employee who used the same non-unique password for several online accounts."The unauthorized extraction of information is epidemic and essentially unstoppable," says Phil Lieberman, CEO of Lieberman Software, which makes password security systems.Goldenberg's caper illustrates just how easy it can be. In an interview, he said it all began in September 2007 when one of the sales reps who reported to him at AMX jumped ship to rival Sapphire, the sales arm of Crestron Electronics, a Rockleigh, N.J.- based maker of conferencing systems. Goldenberg says he inspected the company laptop turned in by the departing rep and found an e-mail from Sapphire welcoming the new recruit.The message, he says, included the Web address to Sapphire's e-mail server and the recruit's new e-mail address and password. Goldenberg says he logged on as the recruit and quickly figured out the log-ons of three other employees. Like the recruit, they used their first name as part of their e-mail address - and as their password."He didn't go searching for this," says Dean Schneider, Goldenberg's attorney. "It basically hit him in the face."For each e-mail account, Goldenberg activated a feature to forward copies of all incoming messages to a fresh Gmail account he created. He then spent long hours and days on end poring. over Sapphire e-mail, says Bergen County prosecutor Brian Lynch. "It was voyeuristic," says Lynch. "That's why we recommended counseling."Court records show Goldenberg may have initially gained access to Sapphire's e-mail months earlier than he claims."Admittedly some of our people's passwords probably were not as strong as they should have been," Suttenberg says. "But just because you have a cheap lock doesn't mean it's legal to pick the lock."The customer whom Goldenberg tried to steal contacted Sapphire to inquire how Goldenberg knew specifics about Sapphire's discount before he did. Suttenberg talked the customer into sticking with Sapphire."He was too blatant," she says of Goldenberg.A new systemSuttenberg has since scrapped the bare-bones e-mail service supplied by her local Internet service provider, which cost her a few hundred dollars a month. She now pays thousands of dollars a month for an in-house Microsoft Exchange e-mail server brimming with security features. She also instructed her 10 employees to change their e-mail account passwords frequently and to avoid passwords "that your coworkers and contacts can figure out."While Suttenberg has buttoned up Sapphire, millions of small-business owners and plenty of big corporations - continue to make it easy for larcenous insiders. With the exception of highly regulated banking and health care companies, most businesses are just beginning to discuss how to repel insider intrusions, security experts say.The basics include taking stock of how sensitive information is conveyed/collected and stored - and strictly controlling who has access to it. "We're seeing 70% to 80% of breaches originating from the inside," says Vladimir Chernavsky, president of DeviceLock, which makes systems that restrict data transfers. "Companies need to enforce security policies