Tsk! I remember reading a white hat pen-test report once where a major US bank had their master MS-SQL server left at the default root user 'sa' and no password

Tsk! I remember reading a white hat pen-test report once where a major US bank had their master MS-SQL server left at the default root user 'sa' and no password. From memory the pen-test team got full access to the main transaction tables within a minute. If I remember correctly, they immediately stopped the testing and reported it to management, but I believe they never heard back as to whether the problem was fixed. If anyone knows more details about this, I am sure we would all appreciate an update.