Original article: https://community.rapid7.com/community/infosec/blog/2012/06/...

Note that the analysis is based on a de-duplicated list of hashes - and it is not a frequency analysis of how many people use passwords. Instead, it is an analysis of how many cracked passwords contain certain strings.

"link" is not the most common password, as the Forbes article claims, but instead, the most common substring in unique cracked passwords.

Yeah, its about substrings, they wouldn't let you define passwords that short.