Also "Some level of production access" could easily include the ability for the attacker to intercept and exfiltrate passwords as users log in.