A company I used to work for is big enough that everyone reading this has heard of it. They had this wonderful security nightmare going on:

When you were hired, the company would issue your user credential with a standard password that was "CompanyName1" and require you to immediately change it at first logon. Everyone knew this password because everyone got it when they were hired.

Password policy required everyone to reset their password every 60 days. Not the worst ever but still pretty aggressive. And with the rise of all the mobile devices connecting with your corp account it was getting to be a worse and worse experience.

Can you guess yet how these two policies are linked in my story?

Well, some of the C-Suite executives didn't have time for any of these security shenanigans. So they would have their executive support person log into an administrative console and reset the exec's password every 59 days to the same value that it currently had, thereby bypassing the password re-use filter.

That value they were continuously setting was... "CompanyName1"

I know of at least two executives that were doing this while I worked there.