Amazingly, 55 percent of the sites accepted weak passwords such as "123456" and "password," while Toys R US, J.Crew, 1-800-Flowers.com, and five other sites sent passwords as plaintext in e-mails.
It's surprising that the people who are setting up the websites are not taking the simple step of making sure that weak passwords and common words are simply not accepted by the software when setting up accounts. Seems to me that that should be their first line of defense. I would expect the IT people in major corporations - who should be hired for their skill, not just promoted into that position as is likely to happen in small companies - to know better.
