Someone at an IT company typed ‘Password1’ into a test account back in 2012, and 12 years later it exposed the data of thousands of children

Ogi Networks Limited (ONL) and Data Cymru have been reprimanded by the Information Commissioner’s Office (ICO) after a 2024 ransomware attack exposed the personal information of 3,300 people, most of them children. As detailed by BBC News, the breach on November 1, 2024 was linked to a test account that had been protected by the password “Password1” for over 12 years.

Hackers stole 42GB of data and encrypted 182.7GB from Data Cymru’s systems by accessing the old “Test2” account. The account was created by ONL in 2012 and was never audited or removed.

David Doodson, head of investigations at the ICO, said, “Password1 is not an appropriate password, it is a wide-open door to nefarious actors.” He added that a single weak password on an account that was no longer needed can leave the door open to a serious cyber-attack affecting thousands.

The ICO put the blame on both companies, not just one

The ICO found that both ONL, which provided IT services to Data Cymru, and Data Cymru itself breached UK GDPR rules. ONL was particularly at fault for creating the vulnerable “Test2” account and failing to remove it for more than a decade.

The company also did not review local administrator accounts after they were first set up. Accounts on three affected systems were using the same weak password for the same extended period.

Data Cymru did not put a proper data protection agreement in place with ONL, creating a gap in accountability between the two. It also did not ensure the dormant test account was identified and removed, or that its password was updated to meet stronger security requirements. Doodson said “these failures did not sit with one organisation alone.”

Since the attack, ONL has brought in independent cyber-security specialists and introduced a process that prompts customers to review active accounts periodically, along with recommendations on accounts that should be removed. The company has also strengthened its account access controls, including multi-factor authentication.

A spokesperson for ONL said that within a week of the attack, the company worked with Data Cymru to check every account on its network and switched off the ones it no longer needed that same day. The spokesperson added that the incident “was limited to the server we hosted for Data Cymru” and that no other customer information held by ONL was affected.

Data Cymru, which merged with the Welsh Local Government Association (WLGA) in 2025, has started periodic account reviews and strengthened its own access controls, including multi-factor authentication. On April 30, 2025, Data Cymru and ONL entered into a new, legally compliant data processing contract.

A WLGA spokesperson said the organization remains “committed to maintaining robust information governance standards.” The spokesperson said measures introduced since the incident include the removal of dormant user accounts, strengthened password and remote access controls, and improved data processing arrangements that clearly define contractual responsibilities for security and audit activities.

The ICO has urged organizations to use strong passwords, protect remote access with multi-factor authentication, regularly review every user account, and be clear about who is responsible for cyber-security when outsourcing services.