Welsh firms censured over ‘Password1’ data breach

Two Welsh organisations have been formally censured by the Information Commissioner’s Office (ICO) following a ransomware attack that resulted in the theft of personal data belonging to 3,300 individuals. The vast majority of those affected were children, highlighting the severe consequences of inadequate digital security measures. Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, received reprimands for their role in the incident.

The cyber-attack occurred on 1st November 2024, exploiting a critical vulnerability within the organisations’ systems. The breach allowed malicious actors to access sensitive information from two specific projects designed to assist children and families. This incident has drawn significant attention to the responsibilities of both service providers and data controllers in safeguarding vulnerable populations.

The root cause of the breach was a test account designated as ‘Test2’, which had existed for more than 12 years. This account had either remained active since its creation or had been accidentally reactivated prior to the attack. For the entire duration of its existence, the account was secured by the password ‘Password1’.

An independent password strength testing tool deemed this credential “very weak. The evaluation indicated that the password could have been cracked in under a second, leaving the system wide open to nefarious actors. This fundamental failure in basic security protocols allowed the ransomware to gain initial foothold access to the network.

The ransomware attack successfully encrypted 182.7GB of data across the affected systems. Furthermore, 42GB of data was extracted directly from Data Cymru’s infrastructure. The compromised information was specifically taken from the two projects supporting children and families.

The scale of the data loss underscores the potential impact of a single weak password attached to an account that was no longer needed. The ICO’s examination focused on both the breach itself and the security protocols in operation at both organisations at the time. The findings revealed significant gaps in how legacy accounts were managed and secured.

David Doodson, Head of Investigations at the Information Commissioner’s Office, stated that “Password1 is not an appropriate password, it is a wide-open door to nefarious actors. He emphasised that this incident demonstrates how a single weak password can leave the door open to a serious cyber-attack affecting thousands. Doodson noted that the responsibility for these failures did not sit with one organisation alone.

ONL created the test account, while Data Cymru retained overall control of its network, including the ability to instruct ONL to create or remove accounts. Neither organisation had put in place sufficiently clear and effective measures to ensure that old accounts were routinely identified and removed. This shared oversight failure allowed the vulnerable account to persist for over a decade without proper review.

In the wake of the incident, ONL implemented a new procedure requiring customers to regularly review active accounts. The company also offered guidance about accounts that ought to be deleted to prevent similar future breaches. Additionally, ONL enhanced its account access controls, including the implementation of multi-factor authentication for all users.

Data Cymru similarly introduced periodic account reviews and bolstered its own account access controls. The organisation rolled out multi-factor authentication across its systems to strengthen its defensive posture. These measures aim to ensure that legacy accounts are identified and removed before they can be exploited by cybercriminals.

On 30 April 2025, both Data Cymru and ONL formalised a legally compliant data processing contract. This step was taken to clarify responsibilities and ensure compliance with data protection regulations. The contract establishes clear frameworks for how data is handled, stored, and protected between the two entities.

The ICO highlighted that the lesson for every organisation is straightforward: use strong passwords and protect remote access with multi-factor authentication. Regularly reviewing every user account is also essential to maintaining robust security. Furthermore, organisations must be completely clear about who is responsible for cyber security when services are outsourced.

David Doodson concluded that basic cyber security controls are not optional, and the negative consequences of not having them can be severe. The reprimands serve as a stark warning to other organisations managing sensitive data, particularly that of children. The incident underscores the need for vigilance in managing digital infrastructure and access controls.

The case illustrates how long-standing technical debt, such as unused test accounts, can become critical security liabilities. Organisations must adopt a proactive approach to account management and credential strength. Failure to do so can result in significant harm to individuals and severe regulatory consequences for the organisations involved.