The first major violation of obvious security practices was having a registry like that in the first place.

The second was giving out access to "companies and associations" that might have "legitimate needs".

THEN we get to morons using passwords like that.