Division 1 College Football Teams and Mascots Keep Showing Up on Breached Password Lists

The Rambling Wreck of Georgia Tech may not have earned a single vote in the AP’s preseason college football Top 25 rankings, but when it comes to appearing on breached password lists, the prestigious university ranks #1.

In conjunction with the kickoff of the college football season, our researchers analyzed more than 800 million compromised passwords (a subset of our larger list included with Specops Breached Password Protection of over 4 billion passwords) to determine the popularity of Division 1 FBS football programs, and their team mascots and nicknames, appearing on breached password lists.

In total, our researchers looked at passwords related to top football playing universities, finding that Georgia Tech or (GT), the University of Kansas or (KU) and the University of Florida or (UF) each appear more than 5 million times on breached password lists, while San Jose State University (SJSU), New Mexico State University (NMSU) and the University of Nevada Las Vegas (UNLV) appear the least.

The complete 2021 Specops Preseason Top 25

Georgia Tech (GT)

University of Kansas (KU)

University of Florida (UF)

Virginia Tech University (VT)

Arizona State University (ASU)

University of Georgia (UGA)

Old Dominion University (ODU)

East Carolina University (ECU)

University of North Carolina (UNC)

University of Southern California (USC)

Southern Methodist University (SMU)

University of Alabama – Birmingham (UAB)

Louisiana State University (LSU)

Florida Atlantic University (FAU)

Brigham Young University (BYU)

University of South Florida (USF)

Penn State University (PSU)

Texas Christian University (TCU)

Florida State University (FSU)

Florida International University (FIU)

Texas A&M University (TAMU)

University of Texas – San Antonio (UTSA)

University of Central Florida (UCF)

University of Texas – El Paso (UTEP)

University of California Los Angeles (UCLA)

Additionally, our researchers also looked at popular college football nicknames and mascots appearing on breached password lists. For the purposes of this research, we excluded any nickname used by more than one university or by a professional sports team(s). Exclusions include ‘Bulldogs’, ‘Cowboys’ and ‘Tigers’, among a few others.

Top 10 Nicknames/Mascots

Utah Utes
Florida Gators
New Mexico Lobos
Florida State Seminoles
Akron Zips
UCLA Bruins
Oklahoma State Pokes
Oklahoma Sooners
Texas Longhorns
Wisconsin Badgers

In total, college football team names and mascots appear more than 77 million times on breached password lists.

Tackling password security risks

College football fans are incredibly passionate about their schools, particularly those in the

SEC and Big12 country, so it’s completely unsurprising that so many people incorporate their favorite teams into their passwords. However, in today’s cybersecurity threat landscape, it’s essential that any use of a college football team name or mascot be part of a much larger and complex password, if they are to be used at all.

Presently, poor password hygiene continues to put both people and businesses at unprecedented risk. Today, passwords are linked to 80% of breaches, and poor password hygiene is an easy entry point for bad actors to exploit in cyberattacks.

In response to the increase in social engineering and brute force attacks, organizations should at the very least block weak passwords, create compliant password policies and target password entropy to enforce password length and complexity while blocking common character types at the beginning/end of passwords, as well as consecutively repeated characters. 

Don’t let a password breach disrupt your ability to root for and enjoy the upcoming college football season. Find out if breached passwords like these are being used in your organization’s Active Directory environment with a free read-only scan by Specops Password Auditor.

Aug 30, 2021 (Last updated on June 9, 2022)

Back to Blog