Summary
- The 1 November 2024 attack exploited a test account created in January 2012 and protected throughout its existence by the weak password Password1.
- Attackers encrypted 182.7 GB of information and took 42 GB from Data Cymru's systems, affecting approximately 3,300 people, mostly children.
- Reprimands published on 20 October 2026 identify failures in account auditing, access controls, contractual arrangements and the division of security responsibilities.
Two Welsh organisations have been reprimanded after a ransomware attack exploited an obsolete technology test account protected by the password Password1, allowing attackers to take information relating to approximately 3,300 people, most of whom were children.
The Information Commissioner’s Office published its findings against Ogi Networks Limited and the Local Government Data Unit – Wales, known as Data Cymru, on 20 October 2026. Investigators identified failures involving account management, password security and the oversight of outsourced technology services.
The attack took place on 1 November 2024. According to the regulator, the attackers encrypted 182.7 GB of information and removed 42 GB from Data Cymru’s systems, compromising personal information associated with two projects supporting children and families.
The route into the environment was a test account named Test2, created by Ogi Networks in January 2012. The account was no longer operationally necessary but had either remained active or been inadvertently reactivated before the attack. Its original weak password had never been replaced.
An obsolete account escaped repeated reviews
Temporary accounts are commonly created while engineers install, configure or test systems. Their permissions allow technical work to be completed before services enter ordinary operation, but those accounts should be reviewed when the activity for which they were created ends.
In this case, Test2 continued to exist for more than 12 years. The ICO found that Ogi Networks had not carried out regular audits capable of identifying and removing accounts it had created within Data Cymru’s network.
The regulator tested the password using a third-party password strength tool, which classified it as very weak and estimated that it could be compromised in less than a second.
The password’s weakness was one element of a larger failure. Data Cymru subsequently introduced stronger password requirements, but those changes were not accompanied by an account review process that identified the obsolete identity and brought it under the newer controls.
Investigators also found that local administrator accounts on three affected systems had retained the same passwords for more than 12 years. These privileged identities are particularly sensitive because they may allow changes to system configuration, user permissions and other important operating functions.
Maintaining an accurate account inventory is consequently central to security management. Organisations need to identify identities used by employees, contractors, service providers and automated processes, together with the permissions assigned to each.
An account created for an earlier installation can remain outside normal management procedures unless the organisation regularly reconciles its actual system configuration with current operating requirements.
Outsourced administration left responsibilities unclear
Ogi Networks provided Active Directory services to Data Cymru, helping manage the identity and access infrastructure used within its network.
Data Cymru retained overall control of the environment, including the authority to instruct Ogi Networks to create or remove accounts. The ICO found that the organisations had not sufficiently documented how the Active Directory services would be delivered, monitored and audited.
As a result, important responsibilities were not allocated with enough clarity. Ogi Networks created and managed technical identities, while Data Cymru relied on those arrangements without carrying out comprehensive, routine reviews of all relevant accounts.
The regulator also found that Data Cymru lacked a contract with Ogi Networks containing legally required data protection terms for the appointment of a sub-processor.
That omission matters because outsourced processing arrangements must define the responsibilities and safeguards applying to information handled on behalf of another organisation.
Technical administration and legal accountability are connected but distinct. A supplier may carry out account changes or maintain infrastructure, while the customer remains responsible for ensuring that the relevant processing arrangements and oversight controls are appropriate.
Clear agreements can identify which organisation authorises privileged access, conducts account audits, investigates unusual activity and maintains evidence that agreed controls have been applied.
Such arrangements must also operate in practice. A contract assigning an audit responsibility provides limited protection if the necessary reviews are not performed or their findings are not acted upon.
Regulator identifies separate GDPR infringements
The ICO found that Ogi Networks infringed Articles 32(1)(b) and 32(1)(d) of the UK General Data Protection Regulation.
These provisions concern the confidentiality and integrity of processing systems and the regular testing, assessment and evaluation of security measures.
Its findings against Ogi Networks centred on inadequate password requirements, the absence of regular account audits and the failure to review longstanding administrator credentials.
Data Cymru was found to have infringed the same security provisions and Article 28(4), which addresses obligations relating to sub-processors.
The findings against Data Cymru included incomplete account reviews, inadequate documentation of outsourced Active Directory administration and the absence of legally required contractual terms.
The regulator issued reprimands to both organisations. It did not announce financial penalties as part of the 20 October action.
The findings establish separate responsibilities rather than attributing every aspect of the incident to either the supplier or the customer alone.
Corrective work followed the attack
Both organisations introduced changes after the incident. Ogi Networks established a process prompting customers to review active accounts periodically and recommending that unnecessary identities be removed.
It also strengthened access controls, including the use of multi-factor authentication, which requires an additional means of verifying identity beyond a password.
Data Cymru introduced periodic account reviews and improved its authentication arrangements. On 30 April 2025, the organisations entered into a data processing contract containing the required provisions.
These measures address weaknesses identified during the investigation, although maintaining their effectiveness will depend on the consistency of future reviews and the completeness of the account information examined.
Reviews need to cover temporary accounts, service identities, privileged users and security groups, as well as ordinary employee accounts. A narrow check of active staff logins may miss historical permissions that remain capable of providing access.
Multi-factor authentication is also particularly important for remote access, where attackers may attempt to use credentials obtained through guessing, theft or other forms of compromise.
Privileged accounts require additional care because the consequences of misuse may extend across several systems. Unique credentials and controlled permissions can help limit the ability of an attacker to move between connected environments.
Legacy access remains a supplier governance problem
The investigation illustrates how technical arrangements can remain in place long after their original purpose has disappeared. Systems may be upgraded, suppliers may change their procedures and new security policies may be introduced without every historical identity receiving the same scrutiny.
Outsourced administration increases the need for a shared understanding of which accounts exist and who has authority to change them. Both the organisation controlling the environment and its technology provider need access to reliable records and agreed review procedures.
For Data Cymru, the attack compromised information connected to services involving children and families, demonstrating the potential consequences when routine infrastructure management fails to protect sensitive records.
The reprimands establish the specific shortcomings that allowed the obsolete account to remain outside effective control. Continued auditing, removal of unnecessary identities and clearly allocated supplier responsibilities are now central to preventing a similar weakness from persisting within the affected systems.
