8.8M records hacked from Danish national registry with password 123456

Any time people question why government (or companies) shouldn’t be trusted with massive centralized databases of PII, point them to this.

Policies can only do so much. If you set a policy, there’s no way to ensure that future users/admins won’t allow violations for convenience, and yes this holds even if you have criminal penalties.

I hate to say it, but the “best practice” in an increasingly hostile environment may look something like Germany’s byzantine systems that don’t communicate directly with one another.