The clandestine owner of the existing session-the hacker-can, at this point, record and exploit data that is transferred between the new user and the server as long as the session remains active.
For example, when a Task is in an Opened state, the default Developer Lead is the owner of the Task, and the record is mastered at the Dev Lead's database replica site.