Science & Tech · Cybersecurity · 3 hrs ago
Weak test-account password exposed data on 3,300 people in Wales
A ransomware attacker used a weak password on an old test account to break into Data Cymru’s network in Wales.
The account, called Test2, was set up by broadband company Ogi Networks in 2012 and was still active when the attack happened in November 2024.
Its password was “Password1,” which the UK Information Commissioner’s Office said could be cracked in less than a second.
Personal information about 3,300 people, mostly children, was exposed, linked to two projects supporting families.
The ICO reprimanded both Ogi Networks and Data Cymru, finding that Ogi Networks failed to review accounts and Data Cymru failed to ensure the old account was removed or updated.
The regulator said responsibility for the security failures was shared because Ogi Networks created the account while Data Cymru controlled the network.
The two organizations have since signed a data protection contract and strengthened account reviews, including with multi-factor authentication.
The UK Information Commissioner’s Office reprimanded Ogi Networks Limited and Data Cymru after a ransomware attack exposed personal data relating to 3,300 people, mostly children.
The attacker used a dormant test account protected by the password “Password1” to access Data Cymru’s network.
The ICO said the password could be cracked in less than a second and that the account had remained active for more than 12 years.
The attack encrypted 182.7GB of data and involved the theft of 42GB.
The regulator cited failures by both organisations in account security and in identifying and removing old accounts.
- Who
- Ogi Networks Limited and Data Cymru were reprimanded by the Information Commissioner’s Office.
- What
- A ransomware attack exposed personal data relating to 3,300 people, mostly children.
- When
- The attack occurred on November 1, 2024; the ICO issued its reprimands on October 20, 2026.
- Where
- Data Cymru’s network in Wales.
- Why
- The attacker exploited a dormant test account protected by the weak password “Password1.” The ICO also found failures in account reviews and security responsibilities.
This story does not have two clearly opposing sides.
ONL created the Test2 account during its initial project for Data Cymru, according to the ICO.
A ransomware attacker exploited the test account to breach Data Cymru’s network.
The ICO issued reprimands to ONL and Data Cymru.
- People affected
- 3,300, mostly children
- Password
- Password1, rated very weak by the ICO’s cited tool
- Data encrypted
- 182.7GB
- Data stolen
- 42GB
- Test account age
- More than 12 years
- Regulator
- Information Commissioner’s Office
3 sources
What people are saying
Password1 is not an appropriate password, it is a wide-open door to nefarious actors
This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands.
The local administrator accounts on the three impacted systems all had the same password.
This meant that once one system had been breached, the local account hashes could be collected and used by the threat actor to authenticate access to other systems on the Data Cymru network