@tychotithonus Unsophisticated elderly users both times with non unique passwords reused across multiple services. Found both their addresses lighting up the Am I Pwned sites for prior breaches. Passwords were relatively short and not mathematically complex and had characteristics like adding the year to the end.