User refused to change her password because everyone already knew it

Change is constant, but The Register likes to keep some things the same – such as using Friday mornings to bring you a new installment of On Call, the reader-contributed column that shares your tech support stories.

This week, meet a reader we'll Regomize as "Daniel" who told us that in 2020 he was hired to replace a two-person IT department at a UK school.

"The IT manager had left amid some 'accounting irregularities,' mainly involving high-end gaming PCs being purchased using school funds but never making it onto the school site," Daniel told On Call.

"His deputy stepped up just in time to have to deal with a ransomware attack that took the school's entire network offline for three months." The school eventually hired external contractors to rebuild the network and restore from the only available backup, which was months old.

The deputy IT manager then quit without serving their notice period.

Daniel took the vacant job and in his first week the school principal asked him to audit the network and deliver a report explaining how to get things up to scratch.

"I found a few quick wins, including the password policy which at the time was set to six letters.

Just that, no complexity, no expiry," Daniel told On Call.

"And users hadn't been forced to change them since before the ransomware attack.

Or, indeed, ever." The principal approved Daniel's proposed password policy and a requirement for everyone to change their password immediately.

"I was not prepared for the backlash this would create," Daniel wrote.

The school's data manager proudly said she had used the same password since 1998 and justified keeping it on the grounds that everyone on staff knew it.

"She said, 'If I'm not in, they can log in as me and run the reports.'" It gets worse: the password was "letmein" and the data manager had written it on a piece of paper and taped it to her desk.

As Daniel rolled out the new password policy, more complaints rolled in.