All the passwords were stored in Active Directory description fields

It was far too easy for a hacker to get the information