Default password for 33% of my org..
Well - it happened. The day started like any other, except my colleague said their email got hacked. I looked, and indeed it was hacked. Immediately, I reset his password. Then another person said their email got hacked too. I asked both of them when the last time they changed their password was: never.
I wish I was making this up. I called our email provider and asked them if they could let me know who was still on the default. Turns out it was 1/3 of our organization. My predecessor never instituted 'force user to change password', and then nobody changed it. The password for all those emails was 'password'.
This is the same guy that didn't realize you need device isolation nor network isolation for a public wifi network. I guess I shouldn't be surprised. I seriously wish I were making this up.