Everybody knows that a strong password is very important. However, I can't find any citable public example of any kind where a user or users suffered a heavy loss from using bad passwords, or their service provider handling them badly.
There was a study conducted by the Ponemon Institute and IBM in 2015 which estimated that the average information breach costs a business $3.79M, with an additional $1.57M in reputational damage.
However, it's really hard to determine whether these are caused purely by password security, or whether the incident was caused by some other vector of badness. There's one identifiable case of a bad password being used to cause reputational damage to NATO countries here:
Wikileaks wents through a lot of effort to redact the diplomatic cables. They also released an a big insurance file that contained all of the unredacted diplomatic cables in an encrypted container. Unfortunately they reused a password for this purpose that Wikileaks also used when sharing files with the Guardian. David Leigh, a journalist of the Guardian then published that password in his book about Wikileaks not knowing that the password is the password for the insurance file.
A bit earlier Daniel Domscheit-Berg and other individuals left Wikileaks. In the process of leaving Wikileaks they took the database of documents with them. Among them alledgly the No Fly List and a huge trove of documents from Bank of America.
Julian Assange demanded that they give the data back to Wikileaks. Daniel and people around him argued that Julian Assange and the current Wikileaks team weren't capable of keeping the data safe. A bit later Daniel or people around him allegedly told a newspaper about the fact that the password published in the book of the Guardian journalist is indeed the password for the insurance file.
This inturn lead to the data about the diplomatic cables being out their in the open in an unredacted fashion. Wikileaks then decided to publish everything in an redacted form. Names of sources in the diplomatic cables became public. Daniel and the people who left Wikileaks then reportedly decided to delete the trove of data they took with them and the Bank of America data never saw the light of day. The whole fiasco produced a lot of bad will with Daniel Domscheit-Berg being thrown out of the Chaos Computer Club.
It's a story of how even people who are highly versed in computer security can still get password management wrong with grave consequences.