The NCSC's first 'UK cyber survey' published alongside global password risk list (ncsc.gov.uk)

Their.txt list of the top 100,000 passwords to avoid can be found here:

https://www.ncsc.gov.uk/blog-post/passwords-passwords-everyw...

Well, I guess filtering out the idiots that use '123456' is at least ONE reason to use a '8 characters or more' password rule.