Full Report
School staff seemed to be trying to get ransomware – for a second time
Analysis Summary
# Incident Report: UK School Ransomware Recovery and Weak Password Policy (2020)
## Executive Summary
A UK school's network was taken offline for three months in 2020 by ransomware, and recovery relied on a months-old backup. A new IT lead found a weak password policy (six letters, no complexity or expiry) and widespread password sharing when he was hired to audit the network. Staff resisted the remediation, and the password policy was reverted at the principal's request, though it was later reinstated after the school was taken over by a nonprofit. The article does not describe the initial infection vector or any second ransomware attempt, despite the subtitle's reference to one.
## Incident Details
- **Discovery Date:** Not disclosed (2020, per the article)
- **Incident Date:** 2020 (approximate; exact date not given)
- **Affected Organization:** A UK school (not named)
- **Sector:** Education (K-12 school)
- **Geography:** United Kingdom
## Timeline of Events
### Initial Access
- **Date/Time:** 2020, before the new IT lead was hired (exact date not disclosed)
- **Vector:** Not disclosed
- **Details:** A two-person IT department was in place. The IT manager had left amid "accounting irregularities" involving high-end gaming PCs bought with school funds that never reached the site. The deputy then faced a ransomware attack.
### Lateral Movement
- Not described in the article.
### Data Exfiltration/Impact
- The school's entire network was offline for about three months.
- Recovery used external contractors who rebuilt the network and restored from the only available backup, which was several months old.
- Whether data was stolen or leaked is not mentioned.
### Detection & Response
- **Detection:** Not described; the article only notes the attack occurred.
- **Response actions:**
- External contractors were hired to rebuild the network.
- The network was restored from the single available backup.
- The deputy IT manager resigned without serving notice.
- The new IT lead was asked by the principal to audit the network and report on remediation.
- A new password policy was proposed and approved, with a requirement for all users to change passwords. The requirement was later reverted under pressure from staff and the principal.
## Attack Methodology
The article does not describe attacker techniques. The following reflects only the weaknesses the auditor identified:
- **Initial Access:** Not disclosed.
- **Persistence:** Not disclosed.
- **Privilege Escalation:** Not disclosed.
- **Defense Evasion:** Not disclosed.
- **Credential Access:** Weak and shared credentials were a likely enabler. The password policy allowed six-letter passwords with no complexity. One staff member had used the same password since 1998, which was "letmein," and had written it on paper taped to her desk. Staff also shared access to her account.
- **Discovery:** Not disclosed.
- **Lateral Movement:** Not disclosed.
- **Collection:** Not disclosed.
- **Exfiltration:** Not disclosed.
- **Impact:** Ransomware encrypted or disabled the network for about three months.
## Impact Assessment
- **Financial:** Not disclosed. Costs of contractors and rebuilding are implied but not quantified.
- **Data Breach:** Not disclosed.
- **Operational:** Network offline for approximately three months. Recovery relied on an outdated backup. IT staffing was reduced after a resignation.
- **Reputational:** Not discussed publicly. The article is a reader-submitted anecdote in The Register's "On Call" column.
## Indicators of Compromise
- **Network indicators:** None disclosed.
- **File indicators:** None disclosed.
- **Behavioral indicators:**
- Shared logins used for access to other staff members' accounts.
- Password policy not enforced for an extended period (no expiry, no complexity).
- Passwords stored in plain view.
- Infrequent or absent backups, with only one backup set available.
## Response Actions
- **Containment measures:** Not described in detail beyond the network being taken offline.
- **Eradication steps:** Network rebuilt by external contractors.
- **Recovery actions:**
- Restoration from a months-old backup.
- Adoption of a stronger password policy (initially, then reverted, then reinstated after the school was taken over by a nonprofit).
## Lessons Learned
- Weak password policy (six characters, no complexity, no expiry) left the environment exposed, and passwords were not changed even after a ransomware attack.
- Shared credentials undermine accountability and make it impossible to tell who accessed what.
- A single, months-old backup meant a long outage and data loss.
- Small IT teams with a single point of knowledge are fragile; key staff departures compounded the problem.
- Security changes can be reversed under management or user pressure without a clear risk-based decision. Written, documented approval was the auditor's only protection.
- Financial irregularities in IT procurement (unlogged hardware purchases) can indicate broader control weaknesses.
## Recommendations
- **Password policy:** Use length-based requirements (for example, a minimum of 12 or more characters), screen against known breached or common passwords, and avoid arbitrary forced rotation unless there is evidence of compromise. This aligns with NIST SP 800-63B guidance.
- **Multi-factor authentication:** Enforce MFA on email, remote access, and administrative and reporting systems.
- **No shared accounts:** Give each user their own credentials. Use delegated access or role-based permissions for cover, such as reporting roles or delegated mailbox access.
- **Privileged access:** Review who has administrative or data access, and limit it to the minimum needed.
- **Backups:** Maintain multiple backup copies, including offline or immutable backups. Test restores regularly and measure how old the most recent restorable backup is.
- **Incident response planning:** Document roles, contacts, and recovery procedures so the school is not dependent on one or two individuals.
- **Asset and financial controls:** Maintain an asset register and reconcile IT purchases against delivered hardware.
- **Change management and governance:** Get documented leadership sign-off for security policy, and make the risk of reverting security controls explicit. Provide user training on password hygiene and on why shared or written-down passwords are unsafe.
- **Staff training:** Run regular security awareness sessions that cover phishing, credential handling, and reporting suspicious activity.