User refused to change her password because everyone already knew it

Daniel, a new IT employee at a UK school, arrived in 2020 to find a two-person IT department dissolved amid accounting irregularities. His predecessor had left due to the misuse of school funds for expensive gaming PCs that never arrived. Shortly after, a severe ransomware attack crippled the entire network for three months, forcing the school to hire external contractors for network reconstruction and data restoration from a months-old backup.

When Daniel took over, the school principal tasked him with auditing the network and presenting a report on improving the situation. During his investigation, Daniel discovered a concerning password policy: a six-letter password that had remained unchanged since before the ransomware attack, with no complexity requirements or expiration dates. Moreover, the data manager had been using the same password since 1998 and had even written it down and taped it to her desk, stating that everyone on staff knew the password.

Despite Daniel's proposal to enforce a new password policy, including mandatory changes, the data manager staunchly resisted, asserting that her long-time password was a security measure since she would be unavailable to log in and run reports. The password was simply "letmein." Over the next few days, the situation escalated, with the school principal eventually instructing Daniel to reverse the changes and remove the requirement for immediate password updates. Daniel resisted but complied with the principal's request for a written statement.

Daniel's new bosses, who succeeded the principal, agreed with his stance on password security and reinstated the policy. However, the data manager continued to oppose the changes, leading her to resign early from her position to avoid learning the new systems or changing her cherished password.