Poor password practice and policy, and likely a lack of 2FA / physical token security, seem to have contributed to this breach.

Posts and screenshots apparently by the alleged attacker show "P@ssw0rd" and other well-known / readily-guessable passwords from the hacked systems:

<https://spear.cx/Thread-Selling-RO-Thy-arss-shall-be-spanked...>

<https://drive.google.com/file/d/1iZc93XfViOk7izusgIG1ni7Kmsx...>

Originally noted, without references, by ExoticPearTree here: <https://news.ycombinator.com/item?id=48978836>.

NB: If you're going to point out stupidity verging on cliched tropes, do so with sufficient evidence that it doesn't read as a tired and unsubstantiated canard. The fact that this does happen (and apparently did) doesn't mean it's necessarily the case in any specific instance.