The second stage of our attack was undertaken at three agencies and used information gained from the scan to exploit identified vulnerabilities. We did this to prove the vulnerabilities and to demonstrate the sort of information that could be accessed.