If they had used two factor authentication, the weak password would have been a non-issue.