Notes

Back in between December 2022 to January 2023, more than a fifth of the passwords protecting network accounts at the US Dept. of the Interior, including Password1234, Password1234!, and ChangeItN0w!, were weak enough to be cracked using standard methods according to a security audit done by the agency. The audit was performed by the dept.'s inspector general, which obtained cryptographic hashes for over eighty-six thousand employee active directory accounts. Auditors then used a list of over one and a half billion words that included:

-Dictionaries from multiple languages
-US gov. terms
-Pop culture references
-Publicly available password lists harvested from past data breaches from both public and private sectors
-common keyboard patterns (E.G., "qwerty")

The results weren't encouraging. In all, the auditors cracked around twenty-one percent (18,174) of the eighty-six thousand cryptographic hashes tested; two-hundred and eighty-eight of the affected accounts had elevated privileges, and three-hundred and sixty-two of them belonged to senior gov. employees. In the first ninety minutes of the tests, auditors cracked the hashes for sixteen percent of the dept.'s user accounts. The audit uncovered another security weakness - the failure to consistently implement multi-factor auth.. The failure extended to in between twenty-five or eighty-nine percent of twenty-eight high-value assets, which, when breached, have the potential to severely impact operations. "It's likely that if a well-resourced attacker were to capture Dept. AD password hashes, they would have achieved a success rate similar to ours in cracking the hashes," the final inspection report stated. "The significance of our findings regarding the Dept.'s poor password management is magnified given our high success rate cracking password hashes, the large number of elevated privs. and senior gov. employee passwords we cracked, and the fact that most of the Dept.'s HVAs did not employ MFA."
These were the most commonly used passwords as well as the number of users:

Password-1234 | 478
Br0nc0$2012 | 389
Password123$ | 318
Password1234 | 274
Summ3rSun2020! | 191
0rlando_0000 | 160
Password1234! | 150
ChangeIt123 | 140
1234password$ | 138
ChangeItN0w! | 130