There are some things you expect to see in 2026. AI everywhere. Electric cars quietly taking over. Smart homes that know when you have run out of milk.
What you do not expect is that one of the biggest threats to company security is still someone typing 123456 into a login box.
Yet here we are.
A recent piece of research from NordPass lays it all bare. After analysing huge volumes of passwords exposed in real world data breaches, the conclusion is both fascinating and slightly terrifying. Business passwords are often no better than the ones we were being warned about twenty years ago.
The same bad habits, everywhere
Across sectors like healthcare, manufacturing, tech and finance, the patterns repeat themselves. Simple number sequences dominate. Obvious choices like 123456, 123456789 and password keep cropping up. In some cases people are even using their own email address as the password.
That last one is particularly grim. If your username is already public, you have effectively handed an attacker half the keys to the building.
What struck me most was how universal this problem is. This is not a single careless industry or a few unlucky firms. It is a human behaviour issue. Convenience beats caution every time unless systems are designed to protect us from ourselves.
Why attackers love this
From an attacker’s point of view, weak passwords are a gift. Automated tools can try millions of common combinations in seconds. If employees reuse passwords across systems, one breach can quietly unlock several more doors.
This is often how serious incidents begin. Not with Hollywood style hacking, but with someone guessing a password that should never have existed in the first place.
The uncomfortable truth for businesses
Here is the bit that matters. This is not really a technical problem. The tools to fix it have existed for years.
Strong password policies. Password managers. Multi factor authentication. Alerts for leaked credentials. None of this is exotic or expensive anymore.
What is missing is consistency and enforcement. Many organisations still rely on guidance rather than rules, or assume that staff will naturally do the right thing. History shows they will not, especially when speed and convenience are rewarded.
What actually works
From everything I have seen over the years, both professionally and personally, a few things make the biggest difference.
First, remove the burden from users. A good password manager means nobody has to remember anything clever.
Second, enforce unique passwords everywhere. No exceptions.
Third, enable multi factor authentication wherever possible, especially for email and admin accounts.
Finally, treat leaked passwords as inevitable, not hypothetical. Monitor for them and act quickly.
Still relevant, still risky
It is easy to laugh at 123456. It feels like a joke from the early days of the internet. But when that same password is still opening real company systems today, it stops being funny very quickly.
The NordPass research is a useful reminder that cybersecurity does not always fail at the cutting edge. More often, it fails at the front door.
And the front door is still wide open far too often.
