I filed an GDPR/ICO complaint against my university student's union when I discovered that they were using the same password for all the student society/sports

I filed an GDPR/ICO complaint against my university student's union when I discovered that they were using the same password for all the student society/sports club outlook accounts (which regularly processed things like passports and other personal data). They didn't permit changing the passwords on these accounts, and I assumed they were doing something stupid like keeping the passwords in a spreadsheet somewhere, but I was definitely surprised that they used the same password for all 200+ distinct accounts. Their legal team got involved and eventually they did the reasonable thing of letting each group set the password directly and delegating permissions properly. IT is sometimes shockingly bad about this kind of thing.