The policy person at head quarters said, "systems must encrypt sensitive data". The local security office classified passwords as 'sensitive data' and sent a me

The policy person at head quarters said, "systems must encrypt sensitive data". The local security office classified passwords as 'sensitive data' and sent a memo to all staff (sensitive data must be encrypted at rest). The devs encrypted the passwords. The auditors 'checked the box' as the passwords were now encrypted. Everyone moved on and forgot about it. At the time, a few people complained about the details... something about one way hashes. But they complain about everything, so no one listened to them.