> because a critical server was not protected with a password

Sometimes I have a feeling that such omissions should be punishable. High fines or something. Time’s changed, law should change as well.