West Australians could be leaving the door open to hackers by using passwords as basic as “123456” and “password”, with a State Government audit exposing weaknesses in cybersecurity controls.
The embarrassing password habits come as an analysis of exposed logins shows millions of people worldwide are still relying on combinations criminals can easily guess.
In Australia, the three most commonly used passwords are “admin”, “password” and “123456”, according to password security research cited by ANZ in June.
Each is used by tens of thousands of Australians, despite years of warnings about the dangers of weak passwords.
And the problem is not just about people choosing an easy code for their Netflix account.
A report by WA’s Auditor General, released in March, found weaknesses in the way seven State Government entities managed and secured their Microsoft 365 systems.
The audit identified shortcomings in identity and access management, information protection, security monitoring and governance — increasing the risk of cyber attacks, data breaches and disruptions to public services.
The findings come as cyber criminals increasingly use stolen usernames and passwords to break into personal accounts and corporate networks.
The Australian Signals Directorate’s Australian Cyber Security Centre received more than 42,500 calls to its cyber security hotline in 2024-25, an increase of 16 per cent on the previous year.
It also responded to more than 1200 cyber security incidents, up 11 per cent, according to its annual cyber threat report.
The global password analysis cited by British insurance firm Alan Boswell Group found “123456” had been used by about 210 million people, while more than 52 million had chosen “password”.
About 2.5 million used “computer”.
Soccer teams and bands also featured prominently, with Chelsea and Metallica among the names appearing in exposed password lists.
The figures were drawn from information tracked by Have I Been Pwned, a website that records passwords exposed in data breaches.
Alan Boswell Group spokesman Heath Alexander-Bew warned that weak passwords could quickly expose sensitive information.
“For individuals, it could mean someone accessing shopping accounts, banking apps or social media,” he said.
“For a business, it could open the door to invoices, customer details, internal files or password reset links for other platforms.”
Mr Alexander-Bew said criminals did not always need to guess passwords because many were already circulating in leaked databases.
“They’re sitting in leaked password lists,” he said. “Criminals can use automated tools to try them across different sites.
“That is why passwords such as ‘123456’, ‘admin’, a football team, a name or a birth year can still be risky, especially when reused across work and personal accounts.”
The WA Auditor General’s report found three of the seven government entities audited had weaknesses in all the identity and access management areas examined, while the remaining four had weaknesses in three areas.
They included insufficiently strong multi-factor authentication, particularly for accounts with elevated privileges, and gaps in reviews of user accounts and access rights.
The report said many of the weaknesses were relatively easy and inexpensive to fix.
In a separate warning, WA’s Department of Education confirmed it was among organisations affected by a May 2026 cybersecurity incident involving the Canvas learning management system.
The department said names, email addresses and employee numbers may have been affected but there was no indication passwords, dates of birth or financial information had been accessed.
It urged people to remain alert to scam messages and use unique, strong passphrases.
The national cyber security centre recommends using strong, unique passwords or passphrases, enabling multi-factor authentication wherever possible and keeping devices and software updated.
THE 20 PASSWORDS TO AVOID
- 123456
- 123456789
- 12345678
- password
- qwerty123
- qwerty1
- 111111
- 12345
- secret
- 123123
- 1234567890
- 1234567
- 000000
- qwerty
- abc123
- password1
- iloveyou
- 11111111
- dragon
- monkey
Based on a 2025 list of commonly exposed passwords used by Australians, compiled using NordPass data.
OTHERS TO AVOID
- admin
- admin123
- Pass@123
- P@ssw0rd
- Password1!
- Your name, date of birth or other personal details
- Repeated characters, such as aaaaaa
- Keyboard sequences, such as asdfgh or 1q2w3e