The level tells us that a hexdumped file has been compressed multiple times, and we need to decompress it in order to get the password. We first created a directory under /tmp and copied the data.txt file there. Using the xxd command, we can take the data.txt file and convert it back into the compressed file. Using the file command we can inspect the
result and figure out what command we need to use. I suppose there could be a way of automating this, but I just manually uncompressed the file each time until I got down to the original ascii text.

bandit12@bandit:/tmp/bandit12$ xxd -r data.txt  > data
bandit12@bandit:/tmp/bandit12$ ls
data  data.txt
bandit12@bandit:/tmp/bandit12$ file data
data: gzip compressed data, was "data2.bin", from Unix, last modified: Thu Jun 15 11:40:53 2017, max compression
bandit12@bandit:/tmp/bandit12$ mv data data.gz
bandit12@bandit:/tmp/bandit12$ gunzip data.gz
bandit12@bandit:/tmp/bandit12$ ls
data  data.txt
bandit12@bandit:/tmp/bandit12$ file data
data: bzip2 compressed data, block size = 900k
bandit12@bandit:/tmp/bandit12$ bzip2 -d data
bzip2: Can't guess original name for data -- using data.out
bandit12@bandit:/tmp/bandit12$ file data.out
data.out: gzip compressed data, was "data4.bin", from Unix, last modified: Thu Jun 15 11:40:53 2017, max compression
bandit12@bandit:/tmp/bandit12$ mv data.out data.gz
bandit12@bandit:/tmp/bandit12$ gunzip data.gz
bandit12@bandit:/tmp/bandit12$ ls
data  data.txt
bandit12@bandit:/tmp/bandit12$ file data
data: POSIX tar archive (GNU)
bandit12@bandit:/tmp/bandit12$ tar -xvf data
data5.bin
bandit12@bandit:/tmp/bandit12$ file data5.bin
data5.bin: POSIX tar archive (GNU)
bandit12@bandit:/tmp/bandit12$ tar -xvf data5.bin
data6.bin
bandit12@bandit:/tmp/bandit12$ file data6.bin
data6.bin: bzip2 compressed data, block size = 900k
bandit12@bandit:/tmp/bandit12$ bzip2 -d data6.bin
bzip2: Can't guess original name for data6.bin -- using data6.bin.out
bandit12@bandit:/tmp/bandit12$ ls
data  data.txt  data5.bin  data6.bin.out
bandit12@bandit:/tmp/bandit12$ file data6.bin.out
data6.bin.out: POSIX tar archive (GNU)
bandit12@bandit:/tmp/bandit12$ tar -xvf data6.bin.out
data8.bin
bandit12@bandit:/tmp/bandit12$ file data8.bin
data8.bin: gzip compressed data, was "data9.bin", from Unix, last modified: Thu Jun 15 11:40:53 2017, max compression
bandit12@bandit:/tmp/bandit12$ mv data8.bin data8.gz
bandit12@bandit:/tmp/bandit12$ gunzip data8.gz
bandit12@bandit:/tmp/bandit12$ ls
data  data.txt  data5.bin  data6.bin.out  data8
bandit12@bandit:/tmp/bandit12$ file data8
data8: ASCII text
bandit12@bandit:/tmp/bandit12$ cat data8
The password is XXXXXXXXXXXXXXXXXX (actual password not shown)
bandit12@bandit:/tmp/bandit12$