Somewhere in your office there is a device whose username is admin and whose password is admin. It has been that way since the afternoon it was installed. It is very patient.
The usual places to find one: the camera recorder in the supply closet, the copier’s settings page, the Wi-Fi printer nobody remembers buying, the battery backup with a network card, the door controller, the screen in the conference room, and the router, which everybody forgot was a computer. The older ones especially shipped with a login printed in the manual. The manual is online. So is everyone else’s.
In 2016 a piece of malware called Mirai went looking for exactly these. Its way in was a list of 62 common default usernames and passwords, tried against routers, cameras, and video recorders across the internet. That list was enough to get it into hundreds of thousands of devices. Mirai didn’t need an exploit. It logged in.
The law has since caught up, slowly. California’s connected-device law, in effect since 2020, tells manufacturers that a password unique to each device, or a forced change before first use, counts as reasonable security. The UK banned universal default passwords on consumer connected products in April 2024. Your copier is from 2017.
Newer gear often arrives with a unique password printed on a sticker. That is a real improvement, and it is also a password on a sticker.
The afternoon
Walk the office with a notepad. Anything with a network cable or a Wi-Fi light and a settings page goes on the list. Sign in to each one, change the admin password to something long and unique, and put it in the firm’s password manager. If something else signs in with that password (a monitoring tool, the camera app on the owner’s phone), update it the same afternoon and check that it still works. A sticky note on the device just moves the default from the manual to the device.
If nobody can sign in because nobody knows the password, write that down too. It’s the most useful line on the list.
If you’d rather someone else carried the notepad, ask us.