Obscure hack that was hard to defend against (DNS or OS vuln) I'd feel sad about.

Not encrypting customer data and transport, plain text passwords, etc.. doesn't make me feel sad, at all.