In the wrong hands, the credentials could have been used to steal sensitive resident and employee information or hijack the city government's email system.