A reader identified as Daniel told The Register's On Call column about his 2020 hire as the replacement for a two-person IT department at a UK school. The previous IT manager had left amid accounting irregularities involving gaming PCs, and his deputy had resigned after dealing with a ransomware attack that took the school's network offline for three months. Daniel's first task was an audit, which revealed a password policy of just six letters, with no complexity, no expiry, and no forced changes since before the attack — or ever.
Daniel's proposed policy requiring everyone to change passwords immediately was approved by the principal, but met with backlash. The school's data manager proudly said she had used the same password since 1998 and saw no need to change it, because everyone on staff already knew it. The password was 'letmein,' and she had taped it to her desk. When complaints mounted, the principal ordered Daniel to revert the change and remove the requirement, which Daniel did only after getting the request in writing.
The principal left three months later, and a nonprofit took over the school. Daniel's new bosses reinstated the password policy, and the data manager again resisted. After a meeting with the nonprofit's IT director, she chose early retirement rather than learn new systems or give up her beloved password. The story is a reminder that even after a serious security incident, organizational culture and management resistance can undermine basic password hygiene.