You don't even need a breach to hack 123456, I expect it to be in every pentester's top20 first-tries (contingent on whatever profile they have on the target, obviously).