“'Password1’ is not an appropriate password”: Two Welsh organisations reprimanded after cyber-attack exposed children’s information

The Information Commission’s Office (ICO) has issued reprimands to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, following a ransomware attack. During the attack the personal information of 3,300 people was taken, the majority of whom were children.

The attack exploited a test account, known as ‘Test2’, that had existed for more than 12 years and had either remained active since it was created or been inadvertently reactivated before the incident. It was found that throughout this period, the ‘Test2’ account was protected by the password ‘Password1’, which, when checked against a third-party password strength tool, was classified as ‘very weak’ and could be compromised in less than a second.

The ransomware attack took place on 1 November 2024 and encrypted 182.7GB of data, with 42GB of data being taken from Data Cymru’s systems. The compromised information related to two projects supporting children and families.

David Doodson, Head of Investigations at the Information Commission's Office, said:

“Password1 is not an appropriate password, it is a wide-open door to nefarious actors.

"This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands.

“The responsibility for these failures did not sit with one organisation alone. ONL created the test account whilst Data Cymru retained overall control of its network, including the ability to instruct ONL to create or remove accounts. Neither had put in place sufficiently clear and effective measures to ensure that old accounts were routinely identified and removed.

“The lesson for every organisation is straightforward: use strong passwords, protect remote access with multi-factor authentication, regularly review every user account, and be completely clear about who is responsible for cyber security when services are outsourced. Basic cyber security controls are not optional, and the negative consequences of not having them can be severe.”

Details of the contraventions

ONL

The ICO found that ONL infringed Articles 32(1)(b) and 32(1)(d) of the UK GDPR by failing to implement appropriate measures to maintain the confidentiality and integrity of its processing systems and by failing to regularly test and evaluate whether its security measures were effective.

In particular, ONL:

• created the ‘Test2’ account in January 2012 with the password ‘Password1’ and did not apply appropriate password-strength and complexity requirements to it;
• failed to conduct regular audits of accounts it had created within Data Cymru’s network, allowing the operationally unnecessary test account to remain in existence for more than 12 years, including over six years after ONL’s obligations under the GDPR came into effect;
• did not review local administrator accounts after their initial deployment, with accounts on three affected systems retaining the same password for more than 12 years.

Data Cymru

The ICO found that Data Cymru infringed Articles 28(4), 32(1)(b) and 32(1)(d) of the UK GDPR.

In particular, Data Cymru:

• did not have a contract in place with ONL containing the legally mandated data protection terms required when appointing a sub-processor;
• did not clearly document how the Active Directory services provided by ONL would be delivered, monitored or audited, creating a gap in the allocation of responsibilities between the two organisations;
• failed to ensure that the dormant ‘Test2’ account was identified and removed or updated to comply with enhanced password requirements it subsequently introduced; and
• conducted account reviews that were not scheduled or routine and did not cover the full contents of Active Directory.

The infringements by both organisations continued without being identified or addressed.

Remedial action taken

Following the incident, ONL introduced a process prompting customers to review active accounts periodically and providing recommendations about accounts that should be removed. It also strengthened its account access controls, including the use of multi-factor authentication.

On 30 April 2025, Data Cymru and ONL entered into a legally compliant data processing contract. In addition, Data Cymru introduced periodic account reviews and strengthened account access controls, including through the implementation of multi-factor authentication.

Lessons for organisations

This incident highlights the importance of basic account management and clear oversight of outsourced services.

Organisations should:

• Remove accounts that are no longer required: Test, dormant and former-user accounts should be routinely identified and deactivated.
• Block weak and commonly used passwords: Password controls should prevent easily guessed credentials such as ‘Password1’ from being used.
• Protect remote access: Multi-factor authentication should be applied to remote access services by default.
• Audit the whole account environment: Reviews should cover all relevant accounts, permissions and security groups, not just a limited subset.
• Avoid shared administrative credentials: Privileged accounts should use unique credentials so that one compromised system does not provide access to others.
• Define responsibilities in contracts: Agreements with IT providers and sub-processors should clearly explain how security controls will be delivered, monitored and audited, and include all legally mandated provisions.