“It’s often as simple as that. When I was researching my book, Dark Territory: The Secret History of Cyber War, Matt Devost, president and CEO of the cybersecurity firm FusionX, told me about his days running the ‘red team’ in war games that tested the vulnerability of NATO communications systems. In one game, Devost was having a hard time cracking the commanding general’s password. So he looked up his biographical sketch on a military website, tried out some of the personal details it cited, and finally hit gold by combining ‘Rutgers,’ where the general’s son was attending college, with a two-digit number, which a commercially available random-numbers generator guessed in less than a second.”
Source: How accurate is Mr. Robot? The show’s data, password, and smart home dangers.