We're still running Debian Squeeze in production at one of the places I work. It had one advantage recently: The SSL package was so old that the heartbleed vulnerability hadn't yet been introduced, lol!
I have a client who was in the same position. They actually still have a few boxes on Etch... and amazingly, one Sarge box:
$ cat /etc/issue
Debian GNU/Linux 3.1 \n \
They're all running a very old hacked-up version of torque that no one remaining at the company can do anything with. At least they're walled off from everything else, I suppose?