User Refused to Change Her Password Because Everyone Already Knew It
The Register, Friday, October 16th, 2026
On Call: after a ransomware attack, a school IT hire's password policy hit a data manager who'd used 'letmein' since 1998.
In The Register's On Call column, a reader describes joining a UK school in 2020 after the previous IT manager left amid 'accounting irregularities' and ransomware took the network offline for three months.
His audit found a six-letter password policy with no complexity or expiry, and passwords that had never been changed.
When he forced resets, the data manager objected that she'd used the same password since 1998 and that everyone knew it so they could run reports; it was 'letmein', taped to her desk.
The principal made him revert the change, but a nonprofit that later took over the school reinstated it.