Three accounts were using the same weak password, allowing a threat actor to rummage through files for ten days.