When a national organization leaves the administrator password on a tool that manages the entire IT Department to the default password.
Also when said default password is publicly documented, known by all trained administrators of this tool, and said tool is exposed to the Internet.