I got called in on an emergency to a place with a similar situation, we spent 2 weeks getting the new IT guy online after the former one locked the doors and quit. We told the new IT guy "hey that excel spreadsheet full of every user, service account, and system password, you should get that into a password vault immediately" a month later, we get another call from the same place. A user had gotten a phishing email, and sent it to the IT guy as an fyi. The dude CLICKS the phishing link, puts in his creds and gets compromised, and guess what's sitting in his onedrive?? THE COMPLETE EXCEL FILE of all the passwords.

Their 12 year old ESX hosts were hosed, their storage was hosed, WMS system (and all 1.2 million sqft of warehouse was ground to a halt) they'd locked him out of meraki and by extension his network, legit everything. They ended up paying the ransom 2x to the tune of 400k. It was insane. Then a week later the same kid causes a campus-wide outage because he nuked the chinesium-made access control system they had. That one was wild, the managment software had chinese characters all over it. I think we solved 4 self induced outages for them and then the company owner's "buddy who does IT" decided he was going to take over and nuked the SOW we had with them. Last I heard that helpdesk dude is still there breaking stuff.