The personal details of 3,300 people, most of them children, were stolen after ransomware attackers got into a Welsh public body's network through a test account protected only by the password “Password1”. The UK Information Commissioner's Office revealed the case on 20 October 2026, when it reprimanded Data Cymru, the Local Government Data Unit for Wales, and its IT supplier Ogi Networks Limited. No sophisticated zero-day was needed. The account, called Test2, had existed for more than 12 years and had never been removed.

How the attack unfolded

Attackers gained initial access on 1 November 2024 through the Test2 account, which was created in 2012 and protected by a password a strength tool rated as very weak, crackable in less than a second. From that foothold they reached a primary domain controller, a file server and a database server. They exfiltrated about 42 gigabytes of data and encrypted a further 182.7 gigabytes. The stolen data related to two projects supporting children and families in Wales. Shared local administrator passwords on multiple systems helped the attackers move laterally, and neither organisation had a process for finding and removing stale accounts.

Shared blame, and no fine

The ICO found both organisations had infringed UK data protection law, but issued reprimands rather than fines. Data Cymru kept overall control of its network, yet had no contract with Ogi Networks containing the legally required data protection terms, and had not clearly documented how supplier services would be monitored. Ogi Networks created the account and had supplied Data Cymru since 2012. David Doodson, the ICO's head of investigations, said: “Password1 is not an appropriate password, it is a wide-open door to nefarious actors.” The case is a warning that outsourcing work does not outsource responsibility.

Source: Infosecurity Magazine