Over 40,000 Administrators Use “admin” and “123456” as Passwords

From January to September 2023, analysts at Outpost24 collected interesting statistics on authentication data. It turns out that IT administrators use tens of thousands of weak passwords, with “admin” being the most popular. In total, researchers examined more than 1.8 million administrator credentials using the Threat Compass threat analysis solution. It is emphasized that all data was obtained from malware targeting applications that store usernames and passwords. Although the collected data was not presented in plain text, researchers explained that most passwords on the list could be easily guessed using simple brute-force methods.

“To narrow our list down to only administrator passwords, we analyzed statistical data stored in the Threat Compass backend, focusing on pages identified as administration portals. In total, we found 1.8 million passwords recovered in 2023 (from January to September),” the Outpost24 report states.

Such administrative portals could provide access to configuration, accounts, and security settings. They could also be used, for example, to track clients and orders, or to perform CRUD operations in databases.

Top 20 Weakest Administrator Passwords

1. admin
2. 123456
3. 12345678
4. 1234
5. Password
6. 123
7. 12345
8. admin123
9. 123456789
10. adminisp
11. demo
12. root
13. 123123
14. admin@123
15. 123456aA@
16. 01031974
17. Admin@123
18. 111111
19. admin1234
20. admin1

The researchers note that while the resulting list is “limited to well-known and predictable passwords,” these passwords were associated with many real administration portals. This means that attackers are generally well-prepared for attacks on privileged users.

Experts emphasize that protecting a corporate network starts with basic security principles, including using long, strong, and unique passwords for every account—especially for users who have access to sensitive resources.