The firm’s password was based on its website name.