Personally I like the T490 a lot. Mine has an IPS screen, usbc, a really comfy keyboard and it’s not too heavy. I got it for 280€ish before the RAMapocalypse.

A thing you may want to be aware of is that thinkpad models might have different configurations. That is, the screen or RAM amount, or internal components might differ between instances of the same model, so it’s good to keep an eye on the specifics of each offer.

As a general rule I would look at the different thinkpad series (the letter before the model number) and then at the different models (newer is usually better, but some changes like the keyboard have been controversial).

My guesses would be that either:

• They conducted an employee survey where someone admitted the company name being a substring of a password they use.
• They used some rudimentary bruteforce methods which matched salted registers or logins (say “Company name123456”.)
• Instead they meant that it is possible to create passwords with the company name in it, but transmitted it poorly.
• Some of the passwords are unsalted.
• The passwords are logged somewhere else.

It goes without saying that if they found a vulnerability with the hashing or salting, it should be highlighted on its own, and in any case it wouldn’t do damage to ask them directly.