Photo: The National Archives (UK) / Wikimedia Commons (CC BY 3.0)
Two years ago today, on 1 November 2024, ransomware hit the systems of Data Cymru, a body that handled data for local government in Wales. Britain's data watchdog has now found that the attackers got in through a test account that had sat unused for years behind the password "Password1".
The personal information of 3,300 people was taken, most of them children. The data related to two projects supporting children and families. The attackers encrypted 182.7GB of data and took 42GB from Data Cymru's systems.
The Information Commission issued formal reprimands, dated 14 October 2026, to Data Cymru and to its IT provider, Ogi Networks Limited, and announced them on 20 October 2026. A reprimand is a formal finding that the law was broken. It carries no fine.
A test account left open for 12 years
According to the watchdog, Ogi Networks created the account, called "Test2", in January 2012 and protected it with "Password1". A third-party password strength tool rated that password "very weak" and estimated it could be cracked in less than a second.
The account was not needed for day-to-day work. It either stayed active from the start or was switched back on by mistake before the attack, and it survived for more than 12 years, including more than six years after the GDPR came into force in May 2018.
It was not the only weak spot. The watchdog found that local administrator accounts on three of the affected systems had kept the same password for more than 12 years, because Ogi Networks never reviewed them after setting them up.
David Doodson, head of investigations at the watchdog, said: "Password1 is not an appropriate password, it is a wide-open door to nefarious actors."
Two organisations, no clear owner
The watchdog did not put all the blame on the IT firm. Ogi Networks created the account, but Data Cymru kept overall control of its network and could tell its provider to create or remove accounts. Neither had clear, routine checks to find and close old accounts.
Data Cymru also had no contract with Ogi Networks containing the data protection terms the law requires when a supplier handles personal data for you. When Data Cymru later brought in tougher password rules, the dormant test account was never updated to meet them.
Ogi Networks was found to have broken Article 32 of the UK GDPR, which requires appropriate security and regular testing of it. Data Cymru was found to have broken Article 32 and Article 28(4), which covers contracts with sub-processors.
"The responsibility for these failures did not sit with one organisation alone," Doodson said.
What has changed since
Both organisations have since added multi-factor authentication, which asks for a second proof of identity beyond a password, and regular reviews of user accounts. They signed a legally compliant data processing contract on 30 April 2025.
An Ogi Networks spokesperson told BBC Wales that the account "should have been removed long before criminals were able to use it". The company said it accepted the findings, had brought in independent cyber security specialists, and that the breach was limited to the server it hosted for Data Cymru.
Data Cymru merged with the Welsh Local Government Association in 2025. The association said there was no evidence the stolen information had been "shared further or misused".
Why it matters
Public bodies across Britain rely on outside IT firms, and this case shows how a gap between client and supplier can go unnoticed for over a decade. The watchdog's advice is basic: use strong passwords, protect remote access with multi-factor authentication, review every account regularly, and agree in writing who is responsible for security.
Police data has faced similar supplier problems. As we reported, hackers have repeatedly breached firms holding British police data.
The families whose details were taken did nothing wrong. They trusted public services with their information, and a password from 2012 that nobody checked was all that stood in the way.
0.00 SRY