Performing a Penetration Test of a Clients network, was forced by the client to call out Server Admin. Sadly, the Admin was in the room in a Directors debrief meeting.
The Admin was using known breached creds that haven't changed in 6 years.
ouch!