Password1 ransomware attack exposed 3,300 people in Wales 2026

Key Points

• In light of a ransomware attack, the Information Commissioner’s Office (ICO) has taken disciplinary action against both Ogi Networks Limited (ONL) and Local Government Data Unit – Wales, also called Data Cymru.
• The ransomware attack occurred on 1 November 2024 and resulted in an exposure of personal data belonging to 3,300 people, mostly children.
• A cyber criminal utilized a dormant test account called “Test2”, which was secured using the password “Password1”.
• ONL had created this test account on 13 January 2012 when it was working on its first project for Data Cymru.
• According to the ICO, “Password1” is described as “very weak” by a third-party password-strength checker, which can be easily cracked within a second.
• 42 GB of data was exfiltrated, and 182.7 GB of data was encrypted on Data Cymru systems.
• It was determined that ONL breached Articles 32(1)(b) and 32(1)(d) of the UK GDPR.
• Data Cymru infringed Articles 28(4), 32(1)(b) and 32(1)(d) of the UK GDPR.
• Neither party was fined monetary sanctions but received reprimands.
• The ICO clarified that responsibilities were divided among ONL, which created the test account, and Data Cymru, which still had control over its network.

Wales (Wales Times) October 20, 2026 – Two Welsh organisations have been formally reprimanded by the UK’s data protection regulator after a ransomware attacker used a long-forgotten test account secured by the password “Password1” to access systems containing information about thousands of people, most of them children.

As reported by Paul Kunert of The Register, the Information Commissioner’s Office issued reprimands to Ogi Networks Limited (ONL), a Welsh broadband and network provider, and the Local Government Data Unit – Wales, known as Data Cymru, after investigating the November 2024 cyber-attack.

The ICO said the attacker exploited an account called “Test2”, which had existed for more than 12 years and had either remained active since its creation or been inadvertently reactivated before the incident. The account was protected by “Password1”, which the regulator said was classified as “very weak” by an independent password-strength tool and could be compromised in less than a second.

What Information Was Taken in the Data Cymru Ransomware Attack?

The ICO said the ransomware attack occurred on 1 November 2024. Before deploying ransomware, the threat actor exfiltrated 42 GB of data from a primary domain controller, a file server and an SQL server.

The attacker then encrypted 182.7 GB of data held on a file server and an internal database server. The ICO said personal information relating to 3,300 people was taken during the attack, with the majority of those affected being children.

As reported by Alex Hickey of North Wales Live, the attack took advantage of the “Test2” account, which had been in existence for more than 12 years and remained secured by “Password1” throughout that period.

Why Did the ICO Reprimand Ogi Networks?

The ICO found that ONL created the “Test2” account on 13 January 2012 during its initial project for Data Cymru. According to the regulator, the account was likely intended to test user access before “real” users were migrated to ONL’s services.

“When it was created, the ‘Test2’ account was given the password of ‘Password1’,” the ICO said in its reprimand of ONL.

The ICO found that ONL infringed Articles 32(1)(b) and 32(1)(d) of the UK GDPR by failing to implement appropriate measures to maintain the confidentiality and integrity of its processing systems, and by failing to regularly test and evaluate whether its security measures were effective.

The regulator also found that ONL did not apply appropriate password-strength and complexity requirements to the “Test2” account. It said ONL failed to conduct regular audits of accounts created within Data Cymru’s network, allowing an operationally unnecessary test account to remain in place for more than 12 years, including more than six years after ONL’s obligations under the GDPR came into effect.

As reported by The Independent, the ICO found that local administrator accounts on the three affected systems all used the same password. This meant that, once one system had been breached, account hashes could be collected and used to authenticate access to other systems on Data Cymru’s network.

The ICO said ONL confirmed it did not carry out reviews of local administrator accounts after their initial deployment. Those accounts therefore remained active and continued to use default passwords set in January 2012 for more than 12.5 years.

Why Was Data Cymru Also Reprimanded?

The ICO issued a separate reprimand to Data Cymru, finding that the organisation had infringed Articles 28(4), 32(1)(b) and 32(1)(d) of the UK GDPR.

According to the ICO, Data Cymru did not have a contract in place with ONL containing the legally required data protection terms for appointing a sub-processor. The regulator also found that Data Cymru did not clearly document how Active Directory services provided by ONL would be delivered, monitored or audited, creating a gap in the allocation of responsibilities between the two organisations.

The ICO further found that Data Cymru failed to ensure that the dormant “Test2” account was identified and removed, or updated to meet enhanced password requirements it later introduced. Its account reviews were not scheduled or routine and did not cover the full contents of Active Directory.

As reported by Nation.Cymru, the ICO concluded that Data Cymru retained overall control of its network, including the ability to instruct ONL to create or remove accounts.

What Did the ICO Say About Password1?

The ICO’s head of investigations, David Doodson, criticised the use of the weak password in unusually direct terms.

“Password1 is not an appropriate password, it is a wide-open door to nefarious actors,”

Doodson said, as reported by The Register.

“This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands,”

he added.

Doodson said responsibility for the failures did not sit with one organisation alone. He said ONL created the test account, while Data Cymru retained overall control of its network, including the ability to instruct ONL to create or remove accounts.

“Neither had put in place sufficiently clear and effective measures to ensure that old accounts were routinely identified and removed,” he said.

What Has Changed Since the Ransomware Attack?

The ICO said ONL has since introduced a process that prompts customers to review active accounts periodically and provides recommendations about accounts that should be removed.

The regulator did not announce a financial penalty against either organisation. Instead, it issued reprimands, which are formal expressions of disapproval and set out the regulator’s findings following an investigation.

The ICO published its findings on 20 October 2026, alongside separate enforcement notices for ONL and Data Cymru.

Background of the Development

Data Cymru is the Local Government Data Unit – Wales, an organisation that helps public bodies across Wales use data effectively. ONL provided server and connectivity infrastructure, licensing and support to Data Cymru.

The “Test2” account was created in January 2012 during ONL’s initial project for Data Cymru. The ICO said it was likely intended to test user-account access before real users were migrated to ONL’s services.

The ransomware attack on 1 November 2024 exploited that account. The ICO’s investigation found that weaknesses in password management, account reviews and contractual data-protection arrangements allowed the intrusion to happen and contributed to the scale of the breach.

Prediction: How This Will Affect Welsh Public Bodies and Families

For families whose children’s information was exposed, the development is likely to increase concern about how public-sector partners and their technology suppliers protect personal data. The ICO’s findings may also prompt affected individuals to seek clearer information about what data was accessed and what support is available.

For Welsh public bodies, councils and organisations working with children’s services, the case is likely to reinforce the need for routine account audits, stronger password controls, removal of dormant accounts and clearer contractual responsibilities with IT suppliers. The ICO’s decision to reprimand both the supplier and the data controller indicates that regulators may expect shared accountability where security responsibilities overlap.

For technology providers serving public-sector clients, the case may lead to greater scrutiny of legacy accounts, default passwords and administrator credentials. Organisations that handle children’s data could face closer checks on whether they can demonstrate regular testing, monitoring and removal of unnecessary access.