When Poor Security Practices Go Bad