'123456' password was the only thing standing between hacker and data of 8.8 million people

Three accounts were using the same weak password, allowing a threat actor to rummage through files for ten days.