Two Welsh organisations have been reprimanded by the Information Commissioner's Office (ICO) after a ransomware attack resulted in the theft of personal information belonging to 3,300 people, the majority of whom were children.
Attack Details
Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, were issued reprimands following the cyberattack on November 1, 2024. The attack exploited a test account named 'Test2', which had existed for more than 12 years. The account had either remained active since it was created or had been inadvertently reactivated before the incident.
Throughout that period, the account was protected by the password 'Password1', which was classified as "very weak" by a third-party password strength testing tool. According to the assessment, the password could have been compromised in less than a second.
Data Compromised
The ransomware attack encrypted 182.7GB of data, with 42GB taken from Data Cymru's systems. The stolen information related to two projects supporting children and families.
The ICO's reprimands follow its investigation into the incident and the security measures in place at the two organisations.
Remedial Actions
Following the incident, ONL introduced a process prompting customers to review active accounts periodically and providing recommendations about accounts that should be removed. It also strengthened its account access controls, including the use of multi-factor authentication.
Data Cymru also introduced periodic account reviews and strengthened account access controls, including through the implementation of multi-factor authentication. On April 30, 2025, both Data Cymru and ONL entered into a legally compliant data processing contract.
Official Response
David Doodson, Head of Investigations at the Information Commission's Office, said: "Password1 is not an appropriate password, it is a wide-open door to nefarious actors."
"This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands."
"The responsibility for these failures did not sit with one organisation alone. ONL created the test account whilst Data Cymru retained overall control of its network, including the ability to instruct ONL to create or remove accounts. Neither had put in place sufficiently clear and effective measures to ensure that old accounts were routinely identified and removed."
"The lesson for every organisation is straightforward: use strong passwords, protect remote access with multi-factor authentication, regularly review every user account, and be completely clear about who is responsible for cyber security when services are outsourced. Basic cyber security controls are not optional, and the negative consequences of not having them can be severe."
