Among the more security savvy community (very much including security.stackexchange) there is an ongoing discussion about the strength of different password policies. Examples include the Tr0ub4d0r&3 vs correct horse battery staple, Bruce Schneiers scheme, the BBC scheme, among others.
These different approaches have all been examined in-depth, down to entropy-level calculations, how easy certain passwords are to remember, etc. -- and I think we can all agree on the qualities good passwords need.
Also, we all know the stories of password, love, 123456, querty and all the other useless phrases that the average Joe sometimes relies upon and that appear every time a large collection of passwords gets leaked somewhere.
But have there actually been known cases where people invested some thought/effort in picking passwords which in hindsight proved to be too weak? I sometimes get the feel that if an organization/person is aware of the password issue, and has even a basic understanding of security principles, they are already 99.9% safe on that front.
To reformulate the question:
How often has password strength been an actual security problem in a professional context?
With 'professional context' I explicitly mean a context where some informed decision was undertaken to choose decent passwords.
E.g. somebody picked a non-trivial password (maybe
Tr0ub4d0r&3-style), and it was actually cracked and exploited in a context where a different scheme would have proven more resilient (and where the reason for the incident was not some other failing part of the security chain).
