The Shared Password, the Phishing Email and the Parent's Request

Weaknesses identified

• Access control: one shared password means no individual accountability, so no one can tell who viewed or changed a record. Departed staff still hold valid credentials, which is an active risk.
• Authentication: the password 'office2024' is short, guessable and built from the school's own name and year; there is no second factor.
• Data protection: medical data about children sits unencrypted in one file with no access levels, so every staff member can see every child's clinic notes.
• Resilience: no backup at all. A deletion, a disk failure or ransomware destroys 240 students' records permanently.
• Human layer: staff have not been trained to recognise phishing, and a shared password normalises the habit of typing credentials into any page that asks.

Single highest-impact change: replace the shared login with individual named accounts on a least-privilege basis, with multi-factor authentication, and disable the leavers' accounts immediately. This is the highest-impact change because it simultaneously closes the ex-staff access, creates an audit trail that makes the other controls enforceable, and blunts phishing, since a stolen password alone no longer grants entry.

Indicators

1. Urgency and threat: a database is 'about to be deleted' and action is required immediately. Pressure to act before thinking is the standard social-engineering lever.
2. Credential harvesting by link: no legitimate service asks users to re-enter a password through a link in an email in order to 'confirm' an account. The page 'identical to the school's login' is a copy hosted elsewhere, and the giveaway is the address bar, not the design.
3. Spoofed sender: a display name of 'Principal' proves nothing; the actual address and reply-to must be inspected, and they will not match the school domain.
4. Personalisation: the use of her name and knowledge of a results database suggests prior reconnaissance, possibly from a data leak or from information exposed by the shared account.

Correct response Do not click. Report it to whoever administers IT and to the principal, then verify by a separate channel, such as phoning the principal or walking to the office.

If the link was clicked and credentials entered Change the password immediately, sign out of all sessions and revoke active sessions, enable multi-factor authentication, run a malware scan, and check the drive's activity log for downloads or deletions. The incident must be reported rather than concealed, because the medical records of 240 children may now be exposed.

Responding to the parent The parent is entitled to know what is held about her own child, but that right does not extend to other children's data. The correct response is to verify her identity and her relationship to the child, then supply an extract containing only that child's rows: allergy notes, clinic visits and guardian contact details. Sending the whole spreadsheet, or a printout with other names visible, would itself be a data breach of 239 other students. The school should also record that the request was made and how it was answered, apply a retention rule so that clinic notes are not kept indefinitely, and tell the parent who to contact if the extract is inaccurate.

Backup arrangement Adopt the 3-2-1 rule: at least three copies of the data, on two different types of media, with one copy kept off site or in a separate cloud account. Backups should run automatically each day, be encrypted because the content is medical data, and be tested by performing an actual restore, since an untested backup is only a hope. At least one copy must be offline or immutable, so that ransomware that encrypts the live spreadsheet cannot reach every copy. Access to the backups should be limited to one or two named people and logged.