Password1 and a 12 year old test account: the ICO reprimands an IT provider and its client

The ICO announced on 20 October that it had issued reprimands to Ogi Networks Limited and to the Local Government Data Unit for Wales, known as Data Cymru, after a ransomware attack in which the personal information of 3,300 people was taken, most of them children. Ogi Networks provided IT services to Data Cymru, which helps public bodies in Wales use data. A reprimand is a formal finding that the law was broken, but it carries no fine.

How the attacker got in

The ICO says the attack, on 1 November 2024, used a test account called Test2 that had existed for more than 12 years and was protected throughout by the password Password1. A password strength tool rated it very weak and able to be cracked in less than a second. The attack encrypted 182.7GB of data and 42GB was taken. The Register, reporting the ICO's reprimand notice, says the local administrator accounts on the three affected systems all had the same password, so once one system was breached the attacker could use it to reach the others. ISPreview reports that the ICO found suspicious activity on the Test2 account as early as 20 September 2024, more than a month before the attack.

What each organisation got wrong

The ICO found that Ogi Networks created the account in January 2012 with that password, did not regularly audit the accounts it had created on Data Cymru's network, and did not review local administrator accounts after they were first set up. It found that Data Cymru had no contract with Ogi Networks containing the data protection terms the law requires when appointing a sub-processor, had not documented how the Active Directory service would be delivered, monitored or audited, and ran account reviews that were not routine and did not cover the whole directory. The ICO's head of investigations, David Doodson, said the responsibility did not sit with one organisation alone. Both organisations have since brought in multi-factor authentication and regular account reviews, and signed a compliant contract in April 2025.

The ICO's six lessons

The ICO lists six steps. Remove accounts that are no longer needed, including test, dormant and former staff accounts. Block weak and common passwords. Put multi-factor authentication on remote access by default. Audit the whole account environment, not a sample. Avoid shared administrator passwords, so one compromised system does not open the others. And set out in contracts with IT providers how security controls will be delivered, monitored and audited.