We have had attackers delete files and change passwords. Probably most annoying is that as far as the system, and the network, is concerned that user is you. So what is a good password. First, the more obscure the better. What you want to avoid is any kind of pattern that can be guessed by a dumb but persistent computer program.
English words are bad, either alone or combined.
Words in reverse are bad. Proper names are very bad. Generally adding one or two letters or numbers is not a good protection, particularly for proper names, i.e., eddieG is not good. Simple or obvious passwords, such as your username or all a's are not good. All numbers are not good.