Weak Password Leads to Ransomware Breach of Welsh Children’s Data

A ransomware incident exploited a dormant test account named Test2 that was protected only by the password “Password1.” The breach allowed threat actors to encrypt 182.7 GB of data and exfiltrate 42 GB from Data Cymru’s systems. The stolen records pertained to two projects supporting children and families and covered 3,300 people, the majority of whom were children.

Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’

Ogi Networks Limited (ONL) has acted as the third-party IT service provider for Data Cymru since January 13 2012, when it created the Test2 account to test user-access procedures. The account retained the same weak password for more than twelve years and was never audited or removed. Local administrator accounts on three affected servers also shared this password, enabling the attacker to move laterally across the network.

ICO reprimands Ogi Networks and Data Cymru after 'Password1' breach affects 3,300 people

Data Cymru, the Local Government Data Unit for Wales, did not have a legally mandated data-processing contract with ONL at the time of the breach, nor did it conduct routine reviews of dormant accounts. Both organisations were later required to formalise their contractual relationship and improve security governance.

Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’

• January 13 2012 – ONL creates the Test2 account with password “Password1.”

The Independent

• 1 November 2024 (scheduled) – The Information Commissioner’s Office (Information Commissioner's Office (ICO)) schedules a reprimand of ONL and Data Cymru following the ransomware incident.

ICO reprimands Ogi Networks and Data Cymru after 'Password1' breach affects 3,300 people

• October 20 – The ICO publishes its reprimand, noting that the infringements persisted without detection.

ICO reprimands Ogi Networks and Data Cymru after 'Password1' breach affects 3,300 people

• 30 April 2025 (occurred) – Data Cymru and ONL enter into a legally compliant data-processing contract.

Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’

• 3,300 records compromised, primarily children’s personal details.

Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’

• 182.7 GB of data encrypted; 42 GB exfiltrated.

Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’

• Test2 account existed for >12 years; same password used on three local administrator accounts.

ICO reprimands Ogi Networks and Data Cymru after 'Password1' breach affects 3,300 people

David Doodson, head of investigations at the ICO, warned that the password “Password1” constituted a “wide-open door to nefarious actors” and emphasized that responsibility for the failures was shared between ONL and Data Cymru.

The Independent

ONL’s spokesperson said the company accepted the ICO’s findings, engaged independent cyber-security specialists, and within a week disabled unnecessary accounts, introduced multi-factor authentication, and began regular account reviews.

BBC News

A Welsh Local Government Association (WLGA) spokesperson confirmed that the reprimand related to the November 2024 incident, noted no evidence of further misuse of the stolen data, and described ongoing efforts to strengthen information-governance, including the removal of dormant accounts and clearer contractual responsibilities.

The Independent

• “Password1 is not an appropriate password, it is a wide-open door to nefarious actors.” — David Doodson

BBC News

Following the April 2025 contract, both ONL and Data Cymru have instituted periodic account reviews, multi-factor authentication for remote access, and stronger password policies. The ICO’s reprimand underscores the expectation that organisations outsourcing cyber-security must maintain clear accountability and robust technical controls to protect vulnerable data.

BBC NewsWalesOnlineThe IndependentThe Register UK