The Onboarding Password Mistake That Creates Unnecessary Risk

Summary: Onboarding credentials shared as temporary first-day passwords over email, SMS, or verbally often stay active, are reused, or are never reset, and the article cites two cases where default credentials opened real systems. In November 2023, the Iranian-linked group Cyber Av3ngers used the default credential "1111" on programmable logic controllers at the Municipal Water Authority of Aliquippa in Pennsylvania to gain control of a remote booster station serving two townships, and in 2025 researchers reached a McHire test environment through a legacy administrator account reportedly using "123456" for both username and password, viewing chat interactions linked to more than 64 million job applications.
What's compelling: The Aliquippa case shows a setup password left on production operational technology gave an Iranian-linked group control of a booster station serving two townships, and the McHire case shows one forgotten test login exposed data tied to more than 64 million job applications.

Read the original at The Hacker News ↗