- The UK's data regulator reprimanded Data Cymru and its IT supplier Ogi Networks after an unneeded test account with the password 'Password1' was used in a ransomware attack.
- The ICO says neither organisation had clear measures to find and remove old accounts, and the paperwork left a gap in who was responsible.
- Leaders should ask who owns the account list at each IT supplier, and whether contracts say how accounts are reviewed.
Most breach stories ask who clicked the wrong link. This one asks a plainer question: who was meant to delete an old account? The answer, according to the ICO, is that neither organisation had put in place clear measures to find and remove old accounts. Data Cymru's paperwork with its IT supplier also left a gap over who was responsible. Outsourcing moves the work. It does not move the responsibility.
What the regulator found
The UK's Information Commissioner's Office (ICO) has reprimanded two organisations. One is Data Cymru, a Welsh body that helps local councils and others work with data. The other is its IT supplier, Ogi Networks (ONL). Infosecurity Magazine reports that ONL has served as Data Cymru's IT provider since 2012.
The case centres on a ransomware attack on 1 November 2024. The attackers got in through an account named 'Test2'. The ICO says it was more than 12 years old. Its password was 'Password1'.
Checked against a third-party strength tool, the password was rated 'very weak'. The ICO says it could be compromised in less than a second. The ICO adds that the account either stayed active from the start or was switched back on by mistake before the attack.
The attack encrypted 182.7GB of data, and 42GB was taken from Data Cymru's systems. The files covered two projects that support children and families. The ICO says the data of 3,300 people was taken, and most were children.
How the attack worked
Data Cymru's network used Active Directory. This is the central list of user accounts in a Windows network and what each one may do. Every account on that list is a working login. It stays one even when nobody needs it.
Infosecurity Magazine reports that the test account gave the attackers a way into the network. Before they locked the files, they copied data from three machines. One runs the account directory itself. One stores shared files. One hosts a database.
The sources do not say how the attackers learned the password. They also do not say whether the login came through remote access.
Nobody owned the clean-up
The ICO stresses shared blame. Its head of investigations, David Doodson, said: "The responsibility for these failures did not sit with one organisation alone." ONL made the account. Data Cymru kept overall control of the network. That control included the right to tell ONL to create or delete accounts.
The ICO says ONL set up 'Test2' in January 2012 with that password. It did not apply appropriate password-strength and complexity requirements. It also did not audit the accounts it had made inside Data Cymru's network.
So the account survived for over 12 years. That includes more than six years after ONL's duties under GDPR began to apply. The ICO also found that administrator accounts on three affected systems kept one password for over 12 years.
Data Cymru had its own gaps, the ICO found. It had no contract with ONL carrying the data protection terms the law requires for a sub-processor. It never clearly set down how ONL's directory service would be run, monitored or audited. Its account checks were irregular and did not cover the whole directory.
The lesson here is that each side held a piece of the job and neither held all of it. A contract that is silent on who reviews accounts leaves that job to chance.
The outcome, and what changed
Infosecurity Magazine reports that neither organisation was fined. The ICO found both had broken the UK GDPR. For ONL, it cited two failures under Article 32(1). ONL had not kept its systems properly protected, and it had not regularly tested whether its controls worked. Data Cymru was also found in breach of Article 28(4), which covers sub-processor arrangements.
Both have made changes. ONL now prompts customers to review active accounts and tightened access controls, including multi-factor authentication. On 30 April 2025 the two signed a compliant data processing contract. Data Cymru added regular account reviews and multi-factor authentication.
Questions to put to your team
Ask who owns the list of accounts at each IT supplier. Ask when it was last checked against the people and systems you have today. Ask whether test, dormant and former-staff accounts are removed on a schedule.
Ask whether password controls block common choices like 'Password1'. Ask whether account reviews cover every account, permission and security group, not a sample. Ask whether privileged accounts have their own credentials, so one breached system does not open others.
Finally, ask whether supplier contracts spell out how security controls are delivered, monitored and audited.
A 12-year-old password is more than a technical slip. It is a record of every review that never happened. The cheapest control in this story was a name next to one question: who still needs this account?
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Information Commissioner's Office (ICO).
