[rozap]

Looks like they went for the low hanging fruit. At my university, I only see wordpress and other massively popular PHP tools. Script kiddies are at it again.

Though, there was one database (at my school) with the passwords in plaintext. Why do people use plain text for passwords. Why.

[jmediast]

If it's anything like ours, they don't like to touch systems that 'work'... They don't have the resources to audit, update, and re-train everyone to use the current version.

Then there are the students hired to build internal tools who wouldn't know SHA1 from Bcrypt/Scrypt...