"Password1 is not an appropriate password, it is a wide-open door to nefarious actors."
That blunt assessment from David Doodson, head of investigations at the UK Information Commissioner’s Office (ICO), encapsulates how a simple, decade-old test account unlocked a chain of failures that led to the theft of sensitive data belonging to thousands of children and their families in Wales.
Compromised "Test 2" account and the ‘Password1’ failure
The ICO’s investigation found attackers gained initial access to Data Cymru’s network through an account labelled "Test 2" that had existed for more than 12 years and was protected only by the password "Password1." Access to that account allowed the threat actor to move through the network, encrypting files and exfiltrating data before deploying ransomware.
The account’s longevity and the absence of appropriate password-strength and complexity requirements were flagged by the ICO as primary operational weaknesses that enabled the intrusion.
Scope: 42GB exfiltrated, 182.7GB encrypted, 3,300 people affected
Before deploying ransomware, attackers removed 42GB of data from a primary domain controller, a file server and an SQL server. The ICO reported the exfiltrated material related to two projects supporting children and families in Wales and included the personal data of 3,300 people, the majority of whom were children.
Separately, the attackers encrypted 182.7GB of data held on file servers and an internal SQL server. The incident took place in November 2024, according to the regulator’s findings.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildRegulatory findings: infringements under UK GDPR and a published reprimand
The ICO concluded that both Ogi Networks Limited (ONL) — acting as Data Cymru’s third-party IT service provider since 2012 — and the Local Government Data Unit – Wales (Data Cymru) infringed UK GDPR requirements in multiple ways. In its reprimand, published on October 20, the ICO said the infringements had continued without being identified or addressed.
Notably, the regulator did not impose a financial penalty. The ICO highlighted remedial steps taken after the incident, including ONL strengthening account access controls and Data Cymru and ONL entering into a legally compliant data processing contract.
Detailed failings attributed to ONL and Data Cymru
- ONL: The ICO identified failures to apply appropriate password-strength and complexity requirements to an account; failures to conduct regular audits of accounts ONL had created within Data Cymru’s network, which allowed an unnecessary test account to remain active for more than 12 years; and not reviewing local administrator accounts after their initial deployment.
- Data Cymru: The ICO criticised the Local Government Data Unit – Wales for lacking a contract with ONL that contained legally mandated data protection terms required when appointing a sub-processor, and for conducting account reviews that were neither scheduled nor routine and did not cover the full contents of Active Directory.
The regulator emphasised that these technical and contractual failings “continued without being identified or addressed,” creating the conditions for the breach.
What this means for local councils, third‑party IT providers, and affected families
- Local councils and organisations that rely on Data Cymru: As an organisation funded by the Welsh government and tasked with enabling local councils and other organisations to find, collect, analyse and present data, Data Cymru’s lapse highlights the downstream risks for councils that depend on third-party platforms for sensitive programme data. Those bodies will need to scrutinise contractual safeguards and insist on routine account audits.
- Third‑party IT providers (ONL and similar vendors): The ICO’s findings put a spotlight on vendor responsibilities — from enforcing password policies and multi-factor authentication to reviewing administrative accounts and maintaining auditable account inventories. ONL’s subsequent action to strengthen account access controls and the parties’ new data processing contract are the concrete corrections the ICO noted.
- Affected families and children: The personal data of 3,300 people, mostly children, was compromised. That group bears the immediate privacy and potential downstream harms from the exfiltrated records; for them, the event is a reminder that operational security lapses within service providers can translate to direct exposure of sensitive family and child-support information.
David Doodson summed the practical takeaway: “The lesson for every organization is straightforward: use strong passwords, protect remote access with multi-factor authentication, regularly review every user account, and be completely clear about who is responsible for cyber security when services are outsourced. Basic cybersecurity controls are not optional, and the negative consequences of not having them can be severe.”
The record in this case is stark and specific: a long‑standing test account, a trivial password, a failure to audit and contractually bind a sub-processor, and the consequential exposure of gigabytes of data and thousands of personal records. The ICO issued a public reprimand and documented remedial steps, but chose not to levy a financial penalty. The facts leave a pointed question for any organisation that outsources critical IT services: will routine audits, contractual clarity, and enforced access controls now be treated as non-negotiable, or will other legacy accounts remain hidden entry points until the next breach forces action?
