UK school reader anecdote: weak six-character passwords and shared 'letmein' credential persisted after ransomware attack
A Register "On Call" column recounts a reader's account (pseudonym Daniel) of joining a UK school in 2020, after the school's network had been taken offline for three months by ransomware. Recovery relied on external contractors and a months-old backup. His audit found a password policy of six letters with no complexity or expiry, and users had never been forced to change passwords. The school's data manager had used the same password, "letmein", since 1998, had taped it to her desk, and shared it with colleagues. The principal briefly reversed the mandatory password change after staff complained. A successor nonprofit later reinstated the policy. This is an anecdotal, unverified story and not a reported incident with technical indicators.
Technical Details
- Password policy was a six-letter minimum with no complexity requirement and no expiry.
- Passwords had not been changed since before the ransomware attack, or ever.
- Credentials were shared among staff and written down on paper.
- The only available backup was months old, which hampered recovery.
Remediation
- Enforce a stronger password policy with length, complexity and rotation or breach-based checks.
- Force credential resets after a ransomware incident.
- Prohibit shared accounts and provide delegated access instead.
- Maintain current, tested backups.
- Secure executive sponsorship for security policy changes.
Linha do tempo
-
UK school reader anecdote: weak six-character passwords and shared 'letmein' credential persisted after ransomware attack
ler a análise desta fonte ocultar
A Register "On Call" column recounts a reader's account (pseudonym Daniel) of joining a UK school in 2020, after the school's network had been taken offline for three months by ransomware. Recovery relied on external contractors and a months-old backup. His audit found a password policy of six letters with no complexity or expiry, and users had never been forced to change passwords. The school's data manager had used the same password, "letmein", since 1998, had taped it to her desk, and shared it with colleagues. The principal briefly reversed the mandatory password change after staff complained. A successor nonprofit later reinstated the policy. This is an anecdotal, unverified story and not a reported incident with technical indicators.
Technical Details
- Password policy was a six-letter minimum with no complexity requirement and no expiry.
- Passwords had not been changed since before the ransomware attack, or ever.
- Credentials were shared among staff and written down on paper.
- The only available backup was months old, which hampered recovery.
Remediation
- Enforce a stronger password policy with length, complexity and rotation or breach-based checks.
- Force credential resets after a ransomware incident.
- Prohibit shared accounts and provide delegated access instead.
- Maintain current, tested backups.
- Secure executive sponsorship for security policy changes.