Many times companies use an initial password that is partially or completely static (Summer2017?), or sometimes they use a formula which includes partial data of the user such as the month of birth + the three final digits of their Social Security, etc…