In my experience password protected files are often password protected for obscure reasons which have nothing to do with the intent of keeping them secret, like:

- prevent anti virus from messing with it

- keep to some obscure regulations wrt. Contacts or law, where is enough if you can argue the data was encrypted.

This type of passwords are use in almost all big corporations. People are being asked to encrypt things but without password managers or keys management tools.

It’s mentioned in the Twitter thread that at least some of the files have a password of “I accept” instead. That leads me to believe that the primary purpose might just be to indicate agreement to an NDA.

The number one (by a wide margin) reason for Intel123 is that somebody is trying to email a zip to somebody else, but a mandatory filter notices "bad files" (oh no, executables!) inside the zip and removes it to keep people "safe". So the zip gets a common, known password, and the recipient gets their files in peace. It's not a security measure at all. It's a workaround for braindead IT "solutions" hindering day-to-day operations. The files can be shared via any number non-encrypted channels just fine, but the particular employees trying to share happen to be most familiar with email and the filter doesn't know or care if there are secrets - there are EXECUTABLES! Those are dangerous, don't you know?

The primary use case for such passwords is not confidentiality. It is to bypass overzealous email virus checkers.

For the life of me, I can't understand why people insist on making passwords with the name of the company in them. It's so absolutely stupid, but common.