‘Password1’ and a forgotten test account land Welsh outfits in hot water
A ransomware attacker broke into Data Cymru’s network using a forgotten test account with the weak password “Password1”, exposing personal information about 3,300 people, mostly children. The UK Information Commissioner’s Office (ICO) reprimanded both Data Cymru and its infrastructure provider, Ogi Networks, over security failures that allowed the account to remain active for more than 12 years.
The attack took place on 1 November 2024. The intruder encrypted 182.7 GB of data and stole 42 GB from servers including a domain controller, a file server and an SQL server. The ICO said Ogi had not reviewed local administrator accounts or audited Data Cymru’s user accounts, while Data Cymru retained control of its network and could instruct Ogi to create or remove accounts; neither organisation received a fine.
- A forgotten test account let an attacker into Data Cymru’s network.
- The “Password1” account had remained active for over 12 years.
- The ICO reprimanded Data Cymru and Ogi Networks.
New here? Start with this
Data Cymru is a Welsh public body that provides data and analysis to support public services. Ogi Networks supplied and managed some of the technology behind its computer network, while Data Cymru retained control over who could have accounts on that network.
The UK Information Commissioner’s Office (ICO) oversees how organisations protect people’s personal information. Its findings concern the responsibilities organisations share when one provides technology services for another, and how long-unused accounts can create risks if they are not checked or closed.
The exposed information related to about 3,300 people, mostly children. The case matters because personal data held for public services can be affected by weaknesses in basic account security, and because both a service provider and its customer may have duties to protect it.