http://csis.org/blog/large-e-mail-phishing-scheme-continues-unfold - this was dated June 25, 2012. "A researcher who examined the list of stolen accounts found that the most commonly used password was “123456.” Further, 42% used lowercase letters a-z and only 6% mixed alpha-numeric characters with other characters. 20% of the passwords were only 6 letters long. A recent report by the security firm Sophos found that 40% of people used the same password for every website. While phishing schemes prey on all users, these statistics strongly demonstrate that internet-users need to be smarter and more aware in choosing passwords that are more difficult to crack (using capitalized letters, symbols, and numbers together), and to vary the passwords they use on the internet." W. David Samuelsen