Are weak passwords to blame for your data breach?

[#1]

Since there has been a lot of ranting (not that it didn't need to be said), many write-ups, and Twitter traffic over the relevance of weak passwords in the last few days with respect to the big data breaches... I thought about it some and figured I would over-simplify and over-generalize... What resulted is this flow-chart, which I think sort of explains the role of weak passwords in some of the more prolific hacks of recent memory...

[#2]

Are weak password responsible for the breaches? No, of course not.

Are passwords irrelevant? Absolutely not! If users of a breached website had weak passwords, those password hashes can be cracked. Since most users register for many sites with the same password (possibly even their bank!), this is a huge risk. If we're talking about a corporate network, the same idea applies. If an attacker can break password hashes due to weak passwords, they can easily reuse those credentials all over the network to perform lateral moves and evade detection/erradication.

You're correct to say that weak passwords didn't cause the breaches, but it's very dangerous to claim passwords are irrelevant.