A test account left behind in 2012, still using the password “Password1”, gave a ransomware gang its way into Data Cymru, the Welsh public sector data body, and led to the theft of records on 3,300 people, most of them children. The Information Commission has now reprimanded both Data Cymru and its managed IT provider, Ogi Networks, and its findings read like a list of the basics every outsourced network should already have in place.
What happened
On 20 October 2026 the Information Commission published two reprimands, both dated 14 October. One went to Ogi Networks Limited (ONL), the Cardiff-based alternative network provider that has run managed IT services for Data Cymru since 2012. The other went to the Local Government Data Unit – Wales, known as Data Cymru, a local government company that helps Welsh councils and other bodies collect, analyse and present data. Since 1 April 2026 its functions have sat with the Welsh Local Government Association.
The attack hit on 1 November 2024. Before deploying ransomware, the intruder took 42GB from a file server, a SQL server and the primary domain controller, then encrypted 182.7GB across the file server and an internal database server. The stolen material came from two projects that support children and families. Data Cymru reported the breach to the regulator on 7 November 2024.
Neither organisation was fined. Both were found to have breached UK GDPR Article 32, covering appropriate security and regular testing of it. Data Cymru also breached Article 28(4), because it had no compliant contract with ONL as its sub-processor. The ONL infringements are recorded as starting on 25 May 2018, when GDPR took effect, and running until October 2025.
The technical picture
The reprimands draw on an incident response report by PureCyber, a Cardiff security firm ONL hired after the attack. It traced initial access to a FortiClient SSL VPN session under the username “Test2”. ONL created that account on 13 January 2012 to check user access before migrating real staff onto its services. It was given the password “Password1” and never removed; ONL says it either stayed active throughout or was reactivated by mistake.
PureCyber concluded the account was most likely compromised through password spraying, where an attacker tries a handful of common passwords across many usernames. A second test account, “testtest”, created in May 2015, also showed suspicious activity. The earliest activity tied to “Test2” dates from 20 September 2024, about six weeks before anyone noticed.
The test account had no administrative rights, but that did not stop the intruder. The local administrator accounts on the domain controller, file server and SQL server all used the same password, which had not changed since the 2012 build. Once one machine was compromised, the attacker could collect the local account hashes and reuse them to authenticate to the others.
Data Cymru did have a strong password policy. Its Group Policy required 15 characters with some complexity rules. But “Test2” pre-dated that policy and, because it had not been used to log in to the domain, it was never prompted to change. Account reviews were ad hoc, and the regulator notes they only asked ONL for members of the “Domain users” group rather than a full export of Active Directory. After the attack, a full review took just over four hours and found eight deprecated accounts, one of which held administrative credentials.
Why it matters for UK organisations
Nothing here was sophisticated, which is why it matters. A large share of UK public bodies, charities and small firms rely on a local managed service provider to build and run their networks, and many of those environments were set up a decade or more ago. The same pattern of orphaned build accounts, remote access protected only by a password and a single shared local admin password is something I would expect to find in plenty of them.
The case also sets out clearly how the regulator now thinks about shared responsibility. David Doodson, Head of Investigations, said the failures “did not sit with one organisation alone”. The account was Ogi’s creation, yet Data Cymru controlled the network and could have told ONL to remove it. The regulator singled out a 2016 order form standing in for a contract and the absence of documented responsibility for Active Directory.
The reprimands were also issued by the new Information Commission, which on 30 September 2026 took over from the Information Commissioner under the Data (Use and Access) Act 2025 and now decides through a collective board. A reprimand is not a fine, but the published detail carries real reputational cost, particularly for a commercial provider.
Expert view
In my experience, test and service accounts created during a migration are some of the most reliable findings on any internal test. They are made in a hurry by an engineer who means to delete them later, they sit outside the joiners, movers and leavers process because no real person owns them, and they never trip a password expiry policy because nobody uses them. A Group Policy password rule only bites when a password changes, so a strong policy on paper can sit alongside a 12-year-old weak password in practice.
The shared local administrator password is the part that turned one foothold into a full breach. Tools such as Microsoft’s Windows LAPS have existed for years precisely to stop this, yet when we test estates built by MSPs we still often see one local admin credential stamped across every server image.
Then there is the six-week gap between first access and discovery. A long-dormant test account suddenly connecting over the VPN is a signal that a simple, cheap alert would catch.
What to do now
- Export your whole directory and review it. Pull every enabled account, not just one group, and confirm a named owner and business need for each. Disable test, build and leaver accounts today (Cyber Essentials: user access control).
- Require MFA on every remote access route. VPN, remote desktop gateways and cloud admin portals should never accept a password alone. Both organisations added MFA to remote access after the attack.
- Block known weak passwords. Use a banned password list or password protection that rejects common choices, and force a reset on accounts whose passwords pre-date your current policy (Cyber Essentials: secure configuration and password-based authentication).
- Make every local admin password unique. Deploy Windows LAPS or an equivalent and rotate built-in administrator credentials on servers and workstations.
- Alert on dormant accounts waking up. Flag VPN or domain logins from accounts that have been inactive for months, and investigate password spraying patterns in authentication logs.
- Fix your MSP contract. Check it contains the Article 28 terms, and that it spells out who creates, reviews and removes accounts, how often, and how that is evidenced.
Bottom line
A forgotten test account and one shared admin password were enough to expose children’s data held for Welsh public services. The regulator’s message is that outsourcing your network does not outsource accountability, and that dull, regular account hygiene is now a legal expectation, not a nice-to-have. If you have not reviewed every account in your directory recently, start there this week.
Sources
- ICO: ‘Password1’ is not an appropriate password: two Welsh organisations reprimanded
- ICO: Reprimand, Ogi Networks Limited
- ICO: Reprimand, Local Government Data Unit – Wales
- The Register: ‘Password1’ and a forgotten test account land Welsh outfits in hot water
- Daily Post: Welsh firms’ ‘Password1’ and ‘Test 2’ fails led to hackers stealing children’s data
- Nation.Cymru: Two Welsh organisations reprimanded after cyber-attack exposed children’s information
