So I just spoke to Brenda.
Does everyone realise that they have set all the passwords to the same thing? Phoenix2018?
So you could just stab in any membership number and log in as that person.
It strikes me that this is not at the forefront of security practices.