In an attempt to reset the student’s passwords after a mistake in a cybersecurity audit, the Oak Park and River Forest (OPRF) High School reset all the students’ passwords to ‘Ch@ngeme!’
During a cybersecurity audit on the school’s systems, an unexpected vendor error resettled all the students’ passwords that prevented all the 3000+ students from logging into their Google accounts.
The Password Reset Email From School
As a means to rectify this issue, the school emailed all the students stating that they had changed all the students’ login passwords to “Ch@ngeme!“.
The email from the School stated, “Due to an unexpected vendor error, the system reset every student’s password, preventing students from being able to log in to their Google account”.
“To fix this, we have reset your child’s password to Ch@ngeme! so they can access their Google account again. This password change will take place beginning at 4 p.m. today”, according to the email sent by the school.
“We strongly suggest that your child update this password to their own unique password as soon as possible.”
This is not an advisable act as this password is common for all the users, and every student will know the other student’s password allowing unlimited access to all the student’s information.
The general procedure is to force logout for every user and ask them to reset their password during their next login.
One of the students’ parents emailed TechCrunch about this act from the school. The email from Manning Peterson said, “This is terribly insecure and you have just invited every single students [sic] accounts to get hacked.My son and I were able to log into several of his peers [sic] google accounts, which gave access to all emails, papers, class work—anything saved on google drive (docs sheets and slides).”
A day after this incident, the school realized the mistake and said in another email that they will be providing a special password process over the weekend.
“AI-based email security measures Protect your business From Email Threats!”
Source: https://cybersecuritynews.com/school-changed-students-password/
