Back about ten years ago I was working at a regional hospital. I've told this story before on Slashdot, but it is relevant here.
I start working there and one of the first red flags was that these idiots didn't have individual user accounts set up. The entire system was based on Windows. They had a general account that everybody from the doctors to the janitors used, and it had a simple five letter password that everybody knew. So, well, basically useless. They had this idea that this made them comply with HIPAA. Uh, no. And their entry code to the ER ambulance entrance was 911. (That is not uncommon.) But it gets better.
They had a global Windows share drive that was a dumping ground for... everything. So this thing had everything from patient information to employee lists to social security number lists for employees to recipes (I kid you not) crappy soup in the hospital kitchen. It was insane. I warned them about it in the first two days or so that I was there and, of course, was ignored.
Predictably, they were shut down with ransomware in the middle of the night. Someone had infected a random computer and it hit that network drive, crippling the hospital. I was working at two in the morning and immediately knew what happened. So I called the IT emergency number and got some tech, who was clearly drunk off his ass. I was literally sitting there walking this guy through logging in on the phone. And knowing the basics of their network topology, I even told him the most obvious way to identify where it was introduced: It encrypted everything it saw, which included the network drive, but you just have to find the computer that has all its local stuff infected. Oh, and by the way, from the language of the ransom note, it was clearly someone from Eastern Europe or Russia. And so on. Eventually they fixed it but it took them about 12 hours.
Well, it gets even better. The morons had all the security cameras accessible on their local network. No VLAN, nothing. And they had a very predictable IP assignment for it. I think it was something like the floor and a camera number. So like 192.45.1.5 for camera 5 on the first floor. That really isn't so bad, except that it shouldn't be globally accessible from any computer in the fucking city. But wait! When you connect to it using a web browser, it squirts out the model number of the camera. And, as you can guess... No, they never set passwords on the damned things, and used the default password. We're talking literally Googling the model of the camera and finding out it was "admin" or something like that.
So I discover this when I'm bored one night on a 24 hour shift. So I'm flipping through cameras, and there were cameras in pretty weird places. Like the playroom for the children in pediatrics. Really, I don't want to know. There was also one on the roof that was a movable camera. I reported it and was ignored. A couple of weeks later, I turned the camera into a tree. When I came back two weeks later, it was still looking at the tree, so obviously nobody was looking at these things.
I won't even get into the shit that happened when they had a bomb threat from some asshat and their incredibly incompetent response to it. They demanded that everybody turn their cell phones off because... reasons I still don't understand. (The real reason was that they wanted a communications blackout.) But it was "Oh my god, if you use your cell phone it might detonate da bomb!" Sure. Well, when they locked down the place my cell phone was in my call room in the middles of the hospital. The local PD obviously had some kind of scanner they were using, because they kept circling around the closet I had to sleep in trying to find the phone. Being idiots, they never found it. In the middle of all this, because they had to have communications, they bring out cell phones the hospital had and start handing them out to critical personnel: Apparently their cell phones won't "set us up the bomb."
Oh, and while they were trying to tell everyone not to use cell phones (and I guarantee the patients and families who were oblivious to all this were using theirs) they left the facility public WiFi on. So, well, hell, nobody could possibly use a text message or something over WiFi and trigger something, right?
Oh, and it gets even BETTER. Their entire electronic health record that they used for the ER was all nice and password protected. The problem was that they had a hidden Windows share drive that exposed the backend of their ER system. Once you opened that, everything was unprotected and plaintext. There were thousands and thousands of records that were accessible. I mean, you could pull up document images that had been scanned in. I estimated about 750,000 records going back about eight years.
But wait! There's more! On ANOTHER "hidden" share drive there was the dumping ground that the IT department used. The most interesting thing on that was a Powerpoint presentation someone had made detailing some of their security vulnerabilities and laying out a two year plan to address it... dated about a year prior.
This happened and I was only there SIX MONTHS. I wasn't trying to do anything specific. This was all completely natural. Kind of like "What happens if I type \\Alpha"? Needless to say, I got the fuck out of this hell hole as quickly as humanly possible. My contract ended and I ran like hell.
So it really doesn't surprise me that the Louve did this, or that one of Hillary Clinton's campaign officials had the password "password".