Twenty-six percent of Western Australian government accounts had weak or commonly used passwords, including 1,464 accounts where the password was just "Password123".
The WA auditor reported that in a review of the state of information security in the government released this week, thousands of accounts across the public service were using weak passwords, with "Password123" being the most common, followed by "Project10" at 994 accounts, and "support" at 866.
More than 12,000 accounts had passwords with variations of the date and season, such as October17 or Summer17; 6,827 had "123" somewhere in the password; and over 5,000 had different versions of the word "password".
In one case, the auditor was able to get administration access to the network of one WA government agency by guessing the password "Summer123".
The auditor found that most agencies didn't support staff in proper password management, meaning that in some cases staff might store their passwords in Word documents or spreadsheets.
The government has agreed to implement new security policies, including secure password storage, multi-factor authentication, and banning the use of common or weak passwords.