Sharing isn't caring if it's an admin password: Pwned

"The client wanted to 'keep things simple' for their team, so they used the same administrative password for both staging and production environments. That password was the hard-to-guess combination of 'admin123.'"

"'In SaaS, the biggest threat is rarely technical. It is human laziness disguised as efficiency,' Shein stated, emphasizing the importance of prioritizing security over convenience."

"A few months after the client first shared the password around, a former contractor logged in to do some 'testing.' But instead of benchmarking the software, they ended up triggering a full data wipe."

A client of Nomadic Soft faced severe data loss after using the same weak password, 'admin123', for both staging and production environments. This password was shared in a Slack channel for convenience. A former contractor, instead of performing testing, triggered a full data wipe. Despite spending over $30,000 on security tools, the client fell victim to human error. The incident illustrates that the biggest threats in SaaS often stem from human laziness rather than technical vulnerabilities.

Read at Theregister