Businesses are being urged to take a closer look at the passwords employees are using, after new analysis revealed the words, names and number combinations appearing most often in leaked password data. Insurance experts at Alan Boswell Group analyzed password data from Have I Been Pwned, which contains hundreds of millions of passwords exposed in data breaches, to identify the most common password choices used online.
The research was broken down into several categories. The most-used and most hackable number and word passwords were found to be:
- 123456
- 123456789
- 12345678
- password
- admin
- 12345
- qwerty
When incorporating names into the password, the following should be avoided:
- Daniel
- Michael
- Jessica
- Thomas
- Michelle
For years being used in password, the following were the most commonly compromised:
- 2020
- 1990
- 2021
- 2000
- 2002
The most common sports team passwords to avoid are:
- Liverpool
- Barcelona
- Juventus
- Pittsburgh Steelers
- Rangers
Sports terminology passwords that are most commonly stolen are:
- Football
- Baseball
- Soccer
- Basketball
- Hockey
When it comes to pop culture-related passwords, avoid:
- Blink-182
- Metallica
- Eminem
- Ronaldo
- Nirvana
The following fictional characters were most commonly used in compromised credentials:
- Superman
- Naruto
- Batman
- Tigger
- Snoopy
Animals used in stolen passwords were:
- Monkey
- Butterfly
- Chicken
- Scorpion
- Spider
Plants:
- Orange
- Banana
- Flower
- Pepper
- Jasmine
Objects:
- Computer
- Diamond
- Silver
- Money
- Guitar
Heath Alexander-Bew, personal lines director at Alan Boswell Group, commented on the findings. “Weak passwords can feel like a small issue, but for a business they can open the door to something much more serious. If someone gets into a work email account, they may also be able to access invoices, customer details, internal files or password reset links for other systems.
“Businesses should not rely on staff simply choosing better passwords on their own. The safer approach is to block the most common leaked passwords, use multi-factor authentication, encourage password managers and stop people reusing the same login across work accounts. It is also worth checking recovery details and forwarding rules after a password reset, because if someone has already been inside an account, changing the password may not be the end of it.”
