A School Hit by Ransomware Reversed Its Password Reset After Staff Complained

A story shared with The Register's On Call column shows how weak password habits can persist even after a serious attack. A reader, called "Daniel", was hired in 2020 to replace a two-person IT team at a UK school. A ransomware attack had already taken the school's network offline for three months. External contractors rebuilt it from the only available backup, which was months old.

In his first week, Daniel was asked to audit the network. He found that the password policy allowed six-letter passwords with no complexity rules and no expiry. Users had not been forced to change passwords since before the attack, or ever. The principal approved a stronger policy and an immediate password change for everyone. Daniel says the backlash was significant. One staff member had used the same password since 1998, kept it because colleagues all knew it, and had it written on paper taped to her desk. The password was "letmein".

Complaints continued as the rollout went ahead. Within two days, the principal ordered Daniel to revert the change and drop the requirement. Daniel resisted but asked for the instruction in writing. The account is a reader's recollection, and the source excerpt does not say what happened next.