An IT supplier's account using 123456 let an intruder run automated lookups against records on 8.8 million people.