UK School Staff Rejected Password Policy Because Credential Was Shared
An IT manager found school staff resisting stronger credentials because they believed sharing a weak password improved workflow efficiency.
Key points
- The data manager used the password "letmein" since 1998 and justified keeping it.
- Staff argued that colleagues needed to access her account to run reports.
- The school suffered a ransomware attack that took the network offline for three months.
A UK school’s data manager justified keeping a weak login credential because she believed sharing the password with staff was necessary for daily operations. An IT manager hired in 2020 reported that the employee had used the same password since 1998, according to a story published by The Register.
The data manager argued that if she was absent, other staff members could log in as her to generate reports. She had written the password, which was "letmein," on a piece of paper and taped it to her desk. The new IT manager, identified as Daniel, noted that this approach created significant security risks during his first week on the job.
Previous Security Failures
The school had previously suffered a ransomware attack that disabled its entire network for three months. The previous IT manager left the position amid accounting irregularities involving gaming PCs purchased with school funds. The deputy IT manager handled the recovery but quit without serving the required notice period. External contractors rebuilt the network using backups that were several months old.
Daniel was hired to replace the two-person IT department and audit the network’s security posture. He found that the existing password policy required only six letters with no complexity rules. Users had not been forced to change their passwords since before the ransomware incident. The principal approved Daniel’s proposal to enforce a stricter policy and require immediate changes.
Operational Resistance
Implementing the new security measures triggered a backlash from school staff who were unaccustomed to strict credential management. The data manager’s justification for keeping the weak password highlighted a cultural resistance to security practices among the workforce. She proudly said she had used the same password since 1998, viewing the shared access as an operational convenience rather than a vulnerability.
Daniel reported receiving multiple complaints as he rolled out the mandatory password updates. The incident illustrates how legacy workflows can persist in organizations even after significant security breaches. The school’s leadership had previously failed to enforce basic hygiene, allowing the same risks to remain unaddressed for years.
What should you do?
Organizations must ensure that shared credentials are eliminated in favor of individual, strong passwords for every user. IT administrators should audit password policies to enforce complexity and expiration requirements. Staff training is essential to shift the culture from convenience-based access to security-focused practices.
What to do and how to stay safe: ransomware
- Enforce a password policy that requires complexity and regular rotation.
- Audit user accounts to identify and remove shared or generic credentials.
- Implement multi-factor authentication to reduce reliance on passwords alone.
- Train staff on the risks of writing down or sharing login information.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why did the data manager justify keeping her password?
She claimed that other staff needed to log in as her to run reports when she was absent.
What was the previous password policy at the school?
The policy required only six letters with no complexity or expiration rules.
Had the school experienced a security breach before?
Yes, a ransomware attack took the network offline for three months prior to the audit.
