Summary
- The November 2024 attack encrypted 182.7GB and resulted in 42GB being taken from Data Cymru, affecting information about around 3,300 people.
- The ICO traced the intrusion to the Test2 account, created in 2012 and still protected by the weak password “Password1”.
- Reprimands dated 14 October and publicised on 20 October identify security auditing and outsourced processing failures, not financial penalties.
The Information Commission’s Office has reprimanded two Welsh organisations after finding that a ransomware attack exploited an obsolete test account secured by the password “Password1”. The incident exposed personal information relating to approximately 3,300 people, most of them children, and revealed failures both in technical account controls and in the management of an outsourced IT service.
The ICO publicised its findings on 20 October, following reprimand documents dated 14 October for Ogi Networks Limited and the Local Government Data Unit – Wales, known as Data Cymru. The attack occurred on 1 November 2024: ransomware encrypted 182.7GB of data and 42GB was taken from Data Cymru’s systems. The information concerned two projects supporting children and families; the regulator did not specify that every record contained the same categories of personal data.
Investigators traced the intrusion to an account labelled Test2, which Ogi Networks had created in January 2012. It had either remained active for more than 12 years or been inadvertently reactivated before the attack. Throughout that period the account retained the original password, which the regulator found was very weak. The fact that it was created for testing rather than for an ongoing business function made its persistence especially difficult to justify.
Ogi Networks had not routinely audited the accounts it created inside Data Cymru’s environment. The regulator also found that local administrator accounts on three affected systems had retained unchanged passwords for more than 12 years. These findings concern the continuing security of account credentials and privileged access, not simply the complexity of one password. Once an obsolete identity remains available, its permissions and the systems reachable through it become part of the organisation’s enduring attack surface.
Responsibility did not rest solely with the service provider. Data Cymru retained overall control of its network but had not clearly documented how Ogi Networks would deliver, monitor and audit Active Directory services. Its own reviews were neither scheduled nor comprehensive and did not cover all Active Directory accounts. A dormant identity therefore remained outside an effective, jointly understood process for identifying accounts that were unnecessary or failed newer password rules.
The ICO identified separate infringements of UK GDPR requirements by the two organisations. It found that Ogi Networks failed to maintain appropriate confidentiality and integrity measures and to test security controls regularly, contrary to Articles 32(1)(b) and 32(1)(d). Data Cymru was found to have infringed those provisions as well as Article 28(4), which concerns the contractual arrangements governing subprocessors.
The contractual finding was not a formality detached from the breach. Investigators said Data Cymru did not have the legally required terms in place with Ogi Networks when appointing it as a subprocessor. Nor was there sufficiently precise documentation allocating responsibility for reviewing the directory and its privileged identities. Technical work could therefore be carried out by one organisation while the authority to request account creation or removal sat elsewhere, without a reliable mechanism ensuring that changes and periodic reviews actually occurred.
Both organisations have since reported remedial work. Ogi Networks introduced a process prompting customers to review active accounts and strengthened access protection, including multifactor authentication. Data Cymru introduced periodic account reviews and stronger account security. On 30 April 2025, they also entered into a data processing contract that the regulator says contains the legally required provisions. These steps follow the original attack; they are not evidence that the weaknesses were absent when the ransomware was deployed.
The regulator issued reprimands rather than financial penalties. Its findings identify failures in account lifecycle management, testing of security controls, outsourced service supervision and contractual governance. The case did not require a novel software exploit: an account created for testing remained available with a password the ICO characterised as very weak.
Service providers often create accounts for commissioning, testing or temporary support, while customers retain authority over which identities should remain active. Data Cymru and Ogi Networks lacked a defined audit process that joined those responsibilities. Reviewing only ordinary user accounts, or applying stronger rules solely when new accounts are created, would not necessarily reveal a long-standing test identity still capable of authenticating.
The stolen information related to approximately 3,300 people, most of them children, whose details were processed through programmes supporting families. Although both organisations subsequently introduced stronger controls and executed a revised processing agreement, those actions came after the November 2024 breach. The reprimands dated 14 October 2026 record that the underlying failings had persisted for years before the incident.
