In KNP's case, it's thought the hackers managed to gain entry to the computer system by guessing an employee's password, after which they encrypted the company's data and locked its internal systems. KNP director Paul Abbott says he hasn't told the employee that their compromised password most likely led to the destruction of the company.
This would have to be the system administrator's password and even then I would say is was poor management if they had access to all.
This is a constant fight that I have with clients. Everything needs to be easy. Security is not a consideration. Then something happens and they look for answers that don't interfere with operations. Everyone else is to blame.
If the data is that important then it should have been secured behind more than one employees password.