"Password1 is not an appropriate password, it is a wide-open door to nefarious actors," said ICO head of investigations David Doodson.
The intrusion and the data taken
On November 1, 2024, Data Cymru suffered a ransomware attack in which the intruder encrypted 182.7 GB of data on a file server and an internal database server. Before deploying the ransomware, the threat actor exfiltrated 42 GB of data from a primary domain controller, a file server and an SQL server, the Information Commissioner's Office (ICO) said. Personal data relating to about 3,300 people — mostly children, the ICO said — was among the information compromised.
The weak account that opened the door
The attack began when a miscreant exploited a long‑standing test account called Test2. Ogi Networks Limited (ONL) told the ICO it created the Test2 account on January 13, 2012, during its initial project for Data Cymru. When it was created, the Test2 account was given the password "Password1." Bitwarden's password strength tool, cited by the ICO, rated "Password1" as "very weak" and estimated a cracking time of less than a second.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildHow a single default password propagated access
The ICO's findings describe a chain reaction that followed the initial breach. The local administrator accounts on the three impacted systems all had the same password, the regulator said. That meant once one system was breached, the attacker could collect local account hashes and use them to authenticate to other systems on the Data Cymru network. ONL confirmed it did not carry out any reviews of local administrator accounts after their initial deployment; consequently, those accounts remained active and continued to use the same default passwords set in January 2012 for more than 12.5 years.
Regulatory reprimands and the legal basis cited
The ICO issued reprimands to both Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, rather than fines. The ICO reprimanded ONL under Article 32 of the UK General Data Protection Regulation, finding that ONL failed to put in place "appropriate technical and organisational measures" to ensure systems and services were safe and that it did not regularly assess or evaluate those measures. The ICO said ONL had no auditing procedures to review user accounts within Data Cymru's Active Directory. The watchdog's separate reprimand of Data Cymru also detailed failures in its security arrangements.
Shared control: the split in responsibility between ONL and Data Cymru
The ICO stressed that responsibility did not sit with one organisation alone. ONL provided server and connectivity infrastructure, licensing, and support to Data Cymru, while Data Cymru retained overall control of its network, including the ability to instruct ONL to create or remove accounts. The regulator concluded that neither organisation had put in place sufficiently clear and effective measures to ensure that old accounts were routinely identified and removed.
What this means for technologists, procurement leaders, and the public
- Technologists and security teams: The ICO's account shows how default and dormant accounts can yield broad lateral access when local administrator credentials are shared across systems; regular reviews and auditable account management were specifically missing here.
- Procurement leaders and service buyers: Contracts that allocate responsibilities for account lifecycle management and auditing matter in practice — the ICO noted both the supplier (ONL) and the customer (Data Cymru) had roles in account creation and removal, and neither had ensured ongoing controls.
- The public and affected individuals: The ICO reported that personal data for about 3,300 people, mostly children, was implicated by the exfiltration — a concrete harm that regulators used when judging the organisations' controls.
The ICO's reprimands — rather than fines — and its detailed recounting of the chain from a test account to mass data exposure leave a clear administrative record: a single, decades‑old test credential and a set of unreviewed local administrator accounts were central to the incident. Whether other long‑standing test accounts or shared local credentials exist elsewhere on similarly configured networks is a question the ICO’s findings imply but do not answer; the regulator has pointedly set out the deficiencies it found in ONL's and Data Cymru's practices.
