Key points
- The data manager used the password "letmein" since 1998 and taped it to her desk.
- The school’s previous ransomware attack left the network offline for three months.
- Staff resisted new security policies, prioritising convenience over credential protection.
An attacker gaining access to this UK school’s network could have used the password "letmein", which was written on paper and taped to a desk. This trivial credential, known to all staff, offered a potential foothold in systems that had not been secured since a previous ransomware incident. The lack of complexity or expiry rules meant the same weak secret remained valid for years, potentially allowing persistent access without needing to breach external defences.
In plain English
The core issue was not a sophisticated software flaw, but a complete breakdown in basic access control. Staff treated passwords as shared utilities rather than personal keys. By allowing anyone to log in using one account, the school effectively removed the barrier between an outsider and its internal data. This meant that once the password was discovered, an attacker could potentially impersonate the data manager and access reports and systems, though the source does not confirm if this occurred.
The background
In 2020, an employee named Daniel joined the school to replace a departed IT manager who left amid accounting irregularities involving gaming PCs. The previous deputy IT manager had dealt with a ransomware attack that took the network offline for three months before quitting. When Daniel audited the network, he found the password policy required only six letters, with no complexity or expiry. Users had not changed their passwords since before the attack, or ever.
What changes now
The principal approved a new password policy requiring immediate changes for all staff. This decision triggered significant backlash, particularly from the data manager, who argued that shared access was necessary for colleagues to run reports in her absence. As the new policy was rolled out, further complaints emerged from staff accustomed to the lax security environment. No further technical fixes or vendor updates were mentioned in the report.
The attacker's path
Teams usually encounter this scenario when shared credentials replace proper access management. Attackers exploit the assumption that internal staff will not challenge weak secrets. The technique relies on social engineering or physical observation to obtain the password, then leverages the lack of individual accountability to move laterally. Check whether shared accounts still exist in your environment, as they obscure audit trails and make containment impossible once a breach occurs.
What to do and how to stay safe: ransomware
- Audit all user accounts to identify and disable shared or generic credentials immediately.
- Enforce a password policy that requires complexity and regular rotation for all staff.
- Implement multi-factor authentication to ensure a stolen password alone cannot grant access.
- Review access logs to detect unusual activity from accounts that should have unique owners.
Step-by-step guide: Ransomware Recovery Plans: 6 Misunderstandings That Block Restoration
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why did the data manager refuse to change her password?
She claimed that other staff members needed to know the password to log in as her and run reports when she was absent.
What was the previous password policy at the school?
The policy required only six letters, with no complexity requirements and no expiration date, allowing passwords to remain unchanged indefinitely.
How long was the school's network offline due to ransomware?
The previous ransomware attack took the school's entire network offline for three months before it was rebuilt from an old backup.
