A ransomware breach in Wales exposed the personal information of thousands of children and their families after hackers accessed a network through an account secured with the password "Password1," according to a reprimand published October 20 by the UK's Information Commissioner's Office (ICO). The regulator cited both Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, for security failures tied to the November 2024 incident. Data Cymru, funded by the Welsh government, helps local councils and other organizations manage data, while ONL has served as its IT provider since 2012.
The attackers entered Data Cymru's network through a compromised test account labeled "Test 2," which had been active for more than 12 years and relied solely on the "Password1" credential for protection. Once inside, the threat actors encrypted 182.7GB of information stored on file servers and an internal database server. Before activating the ransomware, they stole 42GB of data from a primary domain controller, a file server, and an SQL server. The compromised material pertained to two initiatives supporting children and families in Wales and included personal details of 3,300 individuals, most of whom were children.
Both ONL and Data Cymru violated UK GDPR regulations in multiple ways, the ICO found. ONL failed to enforce adequate password-strength and complexity standards for the account, didn't perform regular audits of accounts it had established within Data Cymru's network (allowing the unnecessary test account to persist for over a decade), and neglected to review local administrator accounts after they were initially set up. Data Cymru was faulted for not having a contract with ONL that contained the legally required data protection terms for appointing a sub-processor and for conducting account reviews that weren't scheduled or routine and didn't encompass the full contents of Active Directory. David Doodson, head of investigations at the ICO, said: "Password1 is not an appropriate password, it is a wide-open door to nefarious actors." Neither organization received a financial penalty, though the ICO noted the violations continued without detection or remedy until the attack occurred.
The security lapse highlights how a single vulnerability can cascade into a major compromise when basic cyber defenses aren't in place. The test account remained dormant and unmonitored for years, creating an entry point that attackers exploited to move laterally across the network and access sensitive databases. The absence of multi-factor authentication on remote access and the lack of scheduled account audits meant the weakness went unnoticed until hackers leveraged it. Following the breach, ONL strengthened its account access controls, and both organizations entered into a legally compliant data processing contract, the ICO said.
The regulator's core recommendation is straightforward: organizations must use strong passwords, secure remote access with multi-factor authentication, review every user account regularly, and establish clear accountability for cybersecurity when services are outsourced. Doodson emphasized that "basic cybersecurity controls are not optional, and the negative consequences of not having them can be severe." The case underscores that even long-dormant accounts pose real danger when left unmanaged, particularly in environments handling data about vulnerable populations like children. For decision-makers, the incident serves as a reminder that security postures are only as robust as their weakest credential, and that legacy systems require continuous scrutiny rather than benign neglect. Organizations relying on third-party vendors face heightened responsibility to ensure contractual safeguards and oversight mechanisms are genuinely enforceable, not merely performative.