User refused to change her password because everyone already knew it

In 2020, Daniel was hired as the sole IT person for a UK school after the previous two-person IT department was dissolved. The school's IT manager had left due to accounting irregularities, primarily involving high-end gaming PCs purchased with school funds but not installed on campus. A ransomware attack soon followed, shutting down the entire network for three months. The school then hired external contractors to rebuild the network and restore from an outdated backup.

Daniel was tasked with auditing the network and recommending improvements upon taking the position. He discovered the school's password policy was set to six letters with no complexity or expiration requirements. Furthermore, the users hadn't been required to change their passwords since before the ransomware attack, nor ever before. When Daniel proposed the new password policy and an immediate password change, he faced significant backlash.

The school's data manager had been using the same password since 1998 - "letmein" - and had even written it on a piece of paper taped to her desk. She defended keeping the password because everyone on staff knew it, stating that if she wasn't there, others could log in as her to run reports. The principal eventually ordered Daniel to stop enforcing the new password policy and allow users to keep their old one.

However, Daniel persisted and obtained written permission from the principal to maintain the new policy. When the principal left three months later, a nonprofit organization took over the school, and Daniel's new bosses agreed with his stance on the password policy. The data manager, though, continued to resist the change. Eventually, she retired early to avoid having to learn new systems or change her beloved password.