Passwords were not passed through any hash function - **No encryption** — Passwords were not encrypted in any way - **No salting** — Obviously irrelevant when there is no hashing - **No access controls** — The database was accessible through the web application's SQL injection vulnerability