UK school principal abandons password changes despite ransomware recovery
A UK school’s new IT administrator found that staff were using a weak password policy, including one manager who had kept the same password for decades and shared it with colleagues. When he tried to require password changes, complaints led the principal to reverse the policy, leaving the school’s security exposed after an earlier ransomware incident.
The administrator, identified as Daniel, had been hired in 2020 after a ransomware attack took the school’s network offline for three months and it was rebuilt from a months-old backup. Passwords were only six letters long, had no complexity or expiry rules, and had never been changed. The data manager’s password was “letmein”, written on a note taped to her desk; after a nonprofit took over, it reinstated the policy and she chose early retirement rather than change her password or learn the new systems.
- A school reversed a password security change after staff complaints.
- One manager had used “letmein” since 1998 and shared it.
- A nonprofit later reinstated the policy; the manager retired early.
New here? Start with this
Schools rely on computer systems to store information, manage lessons and support day-to-day work. Staff passwords help control access to those systems, so weak or widely shared passwords can make it easier for someone to get in without permission.
Ransomware is malicious software that can lock or disrupt computer systems, sometimes while attackers demand payment. Recovering from an attack can take months, particularly if the school must restore data from an older backup and rebuild its network.
The principal oversees the school, while an IT administrator manages its technology and security. Their decisions affect how well the school protects staff and pupil information and keeps essential services running.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Requiring stronger passwords and regular changes can be a reasonable response to a ransomware attack that caused months of disruption and data loss. A clear policy could reduce the risk that a guessed or widely shared password gives attackers access, and help the school meet its duty to protect pupils’ and staff members’ information.
The case against
Rigid password changes can frustrate staff and encourage workarounds, such as writing passwords down or reusing predictable ones; they may also distract from other security measures. The principal could reasonably have sought a practical, supported transition that addressed staff concerns while improving protection, rather than imposing a policy that proved difficult to sustain.
Read the full article at the source →
Originally published by The Register as “User refused to change her password because everyone already knew it”.