A ransomware attack on two Welsh organisations led to the theft of personal data belonging to 3,300 people, mostly children, after a test account was protected only by the password "Password1".
The attack on November 1, 2024, targeted broadband company Ogi Networks Limited (ONL) and the Welsh local government data unit, Data Cymru. The Information Commissioner's Office (ICO) has reprimanded both organisations for breaching GDPR rules following the incident.
Vulnerable Test Account
Criminals exploited a test account named "Test2", which had existed for over 12 years. Created in January 2012, the account was protected only with the passcode "Passwrod1", classified as "very weak" by a third-party password strength testing tool. According to the watchdog, this passcode can be compromised in less than a minute. The Test2 account had either been active since creation or was inadvertently reactivated before the incident.
The ransomware attack encrypted 182.7GB of data, with 42GB taken from Data Cymru's systems. The stolen information related to two projects supporting children and families.
Security Measures After Investigation
Following the ICO's investigation, security measures were implemented at ONL and Data Cymru. ONL introduced a process prompting customers to review active accounts periodically and providing recommendations on accounts that should be removed. The broadband company also strengthened account access controls, including multi-factor authentication. Data Cymru similarly brought in periodic account reviews and strengthened access controls.
On April 30, 2025, both Data Cymru and ONL entered into a legally compliant data processing contract, according to WalesOnline.
Official Statements
David Doodson, Head of Investigations at the ICO, said: "Password1 is not an appropriate password, it is a wide-open door to nefarious actors." He added: "This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands. The responsibility for these failures did not sit with one organisation alone."
An Ogi Networks Limited spokesperson said: "We provided IT services to Data Cymru, and a test account set up on its network in 2012 should have been removed long before criminals were able to use it. We accept the Information Commission's findings, and we've acted on them." The spokesperson confirmed that within a week of the attack, every account on the network was checked and unnecessary ones switched off, independent cyber security specialists were brought in, and multi-factor authentication and regular account reviews were introduced. The incident was limited to the server hosted for Data Cymru, with no other ONL customer information affected.
A Welsh local government data unit spokesperson said: "We accept the ICO's reprimand and take its findings seriously. The reprimand relates to a ransomware attack on Data Cymru's systems in November 2024." The spokesperson noted that Data Cymru has since merged with the WLGA, with staff and functions transferred into the Association in 2025. There is no evidence that the compromised information was shared further or misused. Measures have been put in place to strengthen arrangements identified by the ICO, including removal of dormant accounts, strengthened password and remote access controls, and improved data processing arrangements.
