The Biggest Hacking Target Is Still "123456"

Jacob Bruggeman

Oct 29, 2026

4

2

Share

“Black October.” That’s what some commentators are calling the avalanche of AI-driven exploits made public this month. “In the last 2 days,” John Milinovich, a self-described “99th percentile tech optimist,” wrote on X, “there have been several dozen cyber attacks which, in isolation, would each have been the worst to happen in an entire calendar year.”

The worst of it came through PHP, the programming language behind much of the web. The National Security Agency warned that two newly disclosed flaws “often provide a direct path to the server’s file system or database” and told organizations unable to patch to take their systems offline. The Wall Street Journal reported that the bugs could enable the “takeover of as many as 70% of the world’s websites.”1 The Internet Archive went dark, 4chan went read-only, and Something Awful shut its forums “as American sites brace for the PHP patch.” Economist and blogger Noah Smith, borrowing the technology analyst Azeem Azhar’s description of “the internet’s Wuhan moment,” raised “the possibility that the internet itself, as we have known it, will cease to function—at least, for a while.”

The size and speed of today’s AI-driven data breaches and attacks suggest we are entering a new era of cyber risk to our digitized critical infrastructure. Government networks, financial services, hospitals, universities, and the data that make up our digital identities—hardly anything remains beyond the theoretical reach of hackers wielding powerful AI models to indulge their malicious whims.

Amid the October chaos came a far less discussed report that a hacker had pulled 8.8 million records from Denmark’s national population registry, claiming to have gotten in through an IT contractor’s account protected by the password “123456.”

The episode is a reminder that governments, firms, and individuals already have a savvy trick up their sleeves: password and digital identity management. It’s old hat, to be sure, but perhaps no pathway to individual and organizational security is better than what is still called, in an echo of Progressive Era scientism, “cyber hygiene.”

Indeed, proactive identity governance—our Orwellian term for the suite of techniques to protect accounts and network access, from password hygiene and two-factor authentication to active monitoring of employee accounts in sprawling networks—is perhaps the first and most effective defense of the attack surfaces multiplying before us.

Given the ascent of p(doom) online, expressed in vivid portraits of malicious AI swarms descending upon the internet like a plague of locusts, devouring everything in their path, a scene the blogger Zvi Mowshowitz cleverly called “The Hackening,” you might be puzzled by a suggestion that the trusty password—augmented, perhaps, by an enterprise password manager—is the wind to dispel such a plague.

And you would be right: the password has a dismal, ineffectual history. But it has more to do with us humans than with the password itself—just ask the thousands of network managers who have been pwned because Keith in HR has “123456” as his password.

Keith has been at this for a long time. When the New York Times reported in January 2010 on an analysis of passwords stolen from the company RockYou, it noted a kind of progress: “Back at the dawn of the Web, the most popular account password was ‘12345.’ Today, it’s one digit longer but hardly safer: ‘123456.’”

The password was never built to bear the burden of computer security, but it shoulders it all the same. Its first modern use came on the Compatible Time-Sharing System at MIT in 1961, where, as the security practitioner Andrew J. Stewart observes in his history of information security, its purpose was “to ensure that each user did not use more than her allotted amount of computer time.”2 The password was a resource allocating device before it was a safeguard, and the people entrusted with it proved careless from the start. When Robert Morris and Ken Thompson of Bell Laboratories reported in 1979 on the passwords chosen by Unix users, they found, in Stewart’s summary, that even with rules in place “users tended to pick weak and easily guessed passwords.”3 A year later, the National Bureau of Standards, the Commerce Department agency now called the National Institute of Standards and Technology (NIST), warned federal managers about “the tendency of people to select familiar words such as family names, locations and addresses.” The same guidelines imagined intruders who might “program a computer to systematically generate passwords” and “have the computer repeatedly try to gain access automatically.”4 In other words, the idea of machines guessing passwords entered the federal record in 1980.

The first national password scandal came three years later, courtesy of the 414s, a band of Wisconsin teenagers named for their area code who had wandered into computers at Los Alamos National Laboratory and Memorial Sloan-Kettering Cancer Center.5 Neal Patrick, the group’s seventeen-year-old spokesman, told a House subcommittee that fall that “default passwords are probably the easiest way of accessing computers,” because “large numbers of computers around the country would have the same passwords because the system operators may not take out that time to change the passwords.”6 Robert Morris, the same Bell Labs scientist who had studied Unix passwords, waved away talk of teenage genius. The break-ins, he testified, were “the moral equivalent of stealing a car for joy riding . . . purposes when the keys are left in the ignition.”7 The subcommittee’s 1984 report agreed that Los Alamos had been breached “because systems passwords had not been changed when the system was installed.”8

Neal Patrick, the seventeen-year-old member of the 414s, on the cover of Newsweek, September 5, 1983. The magazine’s story on the 414s ran under the title “Beware: Hackers at Play.”*

Washington’s answer was to take the choice away from people like Keith through more rigorous standards. In April 1985 the Pentagon’s Computer Security Center ruled in its Password Management Guideline, the “Green Book” in its color-coded security series, that “since many user-created passwords are particularly easy to guess all passwords should be machine generated.”9 The Bureau of Standards’ Password Usage standard, issued that May, ordered that any password shipped with a new system “shall be immediately changed.” It also recommended a limit of three tries, with a pause of several seconds between them, to prevent “an automated, high speed, trial-and-error attack on the password system.”10 Such a cure, however, ultiamtely depended on system operators and users following instructions.

Operators and users did not follow those instructions, and emerging techniques soon proved the Bureau right. The worm that Robert Morris’s son, the graduate student Robert Tappan Morris, released in November 1988 carried its own copy of the Unix password-encryption routine that his father “was personally responsible for developing,” and the worm’s version ran “nine times faster than the standard implementation.”11 To guess a password, as John Markoff explained in the Times, the worm “first read the list of users on the target computer and then systematically tried using their names, permutations of their names or a list of commonly used passwords.”12 When Dutch hackers entered thirty-four Defense Department sites between April 1990 and May 1991, the General Accounting Office (GAO) found that “poor password management—easily-guessed passwords and vendor-supplied accounts whose password had not been changed—was the most commonly exploited weakness.”13

By 1994, after intruders planted programs that captured passwords as they crossed the internet, NIST concluded that “static or reusable passwords are obsolete for protecting access to user accounts.”14 Two years later, GAO, reporting on attacks against the Pentagon, described a shift that ought to sound familiar this autumn. Password cracking and theft, it found, “has been automated by attackers; rather than attackers trying to guess legitimate users’ passwords, computers can very efficiently and systematically do the guessing.”15 What changed afterward was scale. Before his arrest in London in March 2002, the British hacker Gary McKinnon “ran an automated search of seventy-three thousand US government computers” and found administrative accounts “whose owners had failed to change their passwords from the default setting (‘password’).”16 By 2024, Microsoft’s president, Brad Smith, could tell Congress that his company “alone detects almost 4,000 password-based attacks against our customers every second of every day.”17

Password guessing was not fully outsourced to machines, though. Kevin Mitnick, the self-proclaimed “World’s Most Famous Hacker,” preferred, as Robert Gehl and Sean Lawson write in their history of social engineering, to “call computer operators up on the phone and simply ask for the password.”18 His approach rested on a principle that modern phishing schemes have automated: a con artist’s pretexts “won’t work on everyone in a given organization, but . . . they will work on at least one person.”19 A hacker, like a con man, needs to fool only one Keith to win.

The password has been declared dead more often than it has been retired. In 2004, Bill Gates announced that “the password is dead,” a statement that, Stewart writes, “in retrospect could not have been more wrong.” Instead, passwords became “increasingly entrenched as the dominant mechanism for authentication.”20 Representative Jim Cooper of Tennessee voiced the frustration at a 2021 hearing on the SolarWinds breach: “Are we stuck with passwords? There has got to be a better way to do this, to interface with humans.”21

The disasters of the 2020s answered him. The ransomware attack that shut down Colonial Pipeline in May 2021 began, as Senator Rob Portman noted at a hearing that June, citing news reports, with “a compromised password of a virtual private network (VPN) account” that lacked multifactor authentication. Colonial’s chief executive, Joseph Blount, conceded that the account “did only have single-factor authentication,” then added, “It was a complicated password, so I want to be clear on that.”22 The February 2024 attack on Change Healthcare began, UnitedHealth Group chief executive Andrew Witty told the Senate, when “criminals used compromised credentials to remotely access a Change Healthcare Citrix portal.” “The portal,” he added, “did not have multi-factor authentication.”23

Blount’s insistence on complexity is revealing, because complexity rules had failed on their own terms. When the Interior Department’s inspector general built a password-cracking rig “for less than $15,000,” investigators “cracked the passwords for 16 percent of the Department’s user accounts” in the first ninety minutes. The most common was “Password-1234,” which met the department’s complexity requirements.24 In 2017 NIST reversed itself. Verifiers “SHOULD NOT impose other composition rules” or require “memorized secrets to be changed arbitrarily,” and must instead check new passwords against “passwords obtained from previous breach corpuses.”25 An agency blog explained why: “complex password rules actually drive us to create predictable, easy-to-guess passwords.”26 The Office of Management and Budget made the reversal binding on federal agencies in 2022: “Password policies must not require use of special characters or regular rotation.”27

The default password, meanwhile, returned as a policy problem. In late 2023, after hackers affiliated with Iran’s Islamic Revolutionary Guard Corps broke into controllers at American water facilities, “likely by compromising internet accessible devices with default or no passwords,” the Cybersecurity and Infrastructure Security Agency (CISA) conceded what Neal Patrick had told Congress forty yea