Somewhere in Western Australia, a government IT employee is probably laughing or crying or pulling their hair out (or maybe all of the above). A security audit of the Western Australian government released by the state’s auditor general this week found that 26 percent of its officials had weak, common passwords -- including more than 5,000 including the word “password" out of 234,000 in 17 government agencies.

Yikes.

[Don't be like these people -- a Post expert helps you manage your passwords.]

The legions of lazy passwords were exactly what you -- or a thrilled hacker -- would expect: 1,464 people went for “Password123” and 813 used “password1." Nearly 200 individuals used “password” -- maybe they never changed it to begin with?

Almost 13,000 used variations of the date and season, and almost 7,000 included versions of “123.”

A table of the 20 most common bad passwords found by the Western Australian government audit. (Telford, Taylor)

The laxness of the passwords might be amusing, but the potential consequences definitely aren’t. Many of these accounts are used to access important information and vital government systems, according to the report -- and several can do so remotely, without any additional vetting or credentials. In one case, the auditors were able to access an agency’s network -- with full system administrator privileges -- by guessing the password: “Summer123.” Overall, the report found that most agencies didn’t help users store their information safely and securely; this meant some employees were storing their passwords in Word documents or spreadsheets.

“After repeatedly raising password risks with agencies, it is unacceptable that people are still using password123 and abcd1234 to access critical agency systems and information,” Auditor General Caroline Spencer said, according to reporting from Western Australia Today.

In the wake of the report, the government has agreed to step up its security game. It’s in the process of developing new practices to help employees store their password information more securely. The new Office of Digital Government will house a cyber security team dedicated to improving security practices government-wide.

Recent years have seen several huge data breaches at major companies. In 2013, an email account breach at Yahoo exposed the data of 3 billion users. In 2016, a breach at the FriendFinder Networks -- including adult content and casual hookup sites like FriendFinder.com, Penthouse.com and Stripshow.com -- hackers accessed 20 years of data, including passwords and personal information. In 2017, a breach at major U.S. credit bureau, Equifax, exposed the personal information, including Social Security numbers, birth dates, addresses and, in some cases, driver’s license numbers, of 143 million consumers.

Weak passwords make you an easy target for hackers. Last year, Verizon’s annual Data Breach Investigations Report -- which looked at hacking incidents at 65 companies -- found that “81 percent of hacking-related breaches leveraged stolen and/or weak passwords." This number has gone up from 50 percent in the past three years.

This isn’t a problem specific to the Western Australian government. In 2014, a U.S. Senate cybersecurity report found that several major breaches had affected important government agencies, including the Department of Homeland Security, the Internal Revenue Service and the Nuclear Regulatory Commission.

“Data on the nation’s weakest dams, including those which could kill Americans if they failed, were stolen by a malicious intruder,” the report said. “Nuclear plants’ confidential cybersecurity plans have been left unprotected. Blueprints for the technology undergirding the New York Stock Exchange were exposed to hackers.”

An analysis of these agencies' cybersecurity practices found tendencies mirroring the Western Australian practices: The use of “password” was common for sensitive accounts and databases, as was poorly stored and guarded credential information.

Even the unskilled hacker can use resources such as lists of common passwords or publicly available personal information to break into your accounts. The Romanian hacker who first revealed Hillary Clinton was using a private email address while she was secretary of state -- known online Guccifer -- was far from a hacking expert. He told the New York Times he broke into more than 100 accounts, including several high-profile figures like Clinton’s adviser Sidney Blumenthal and former secretary of state Colin L. Powell, just by reading their Wikipedia pages and guessing based on their personal information. A fun fact: Guccifer was also responsible for leaking former president George W. Bush’s paintings.

The traditional guidelines for strong passwords -- make them long and complicated, use symbols and a mix of upper and lowercase letters, change them regularly -- were making it easier for hackers, Paul Grassi of the National Institute of Standards and Technology told NPR last June. The organization’s current guidelines for good passwords are that they should be simple, long and easy to remember. It suggests using normal English words and phrases that are easy for users but tougher on hackers.

If you want to keep your accounts secure, pick something that’s lengthy and memorable, and if you change it, switch more than a single letter or digit. And for heaven’s sake, don’t use the word “password.”