- Hackers accessed a test account protected by the password ‘Password1’, which had remained in place for more than 12 years.
- The attack exposed 3,300 people’s personal information, mostly children, and encrypted 182.7GB of data.
- The ICO found failures at both Ogi Networks and Data Cymru, including weak account controls and unclear responsibilities for data security.
Thousands of children’s personal details were exposed in a cyber-attack after hackers accessed a dormant account protected by the password ‘Password1’, the UK’s Information Commissioner's Office (ICO) has said.
The watchdog reprimanded Ogi Networks Limited (ONL) and Data Cymru over the attack, which took place on November 1, 2024. The hackers used a test account called Test2, created in 2012, to gain access to systems holding information linked to two projects supporting children and families.
The breach affected 3,300 people, mostly children. During the ransomware attack, hackers encrypted 182.7GB of data and stole 42GB from Data Cymru's systems.
The ICO said the organisations had breached UK data protection rules by failing to protect their systems adequately and by not regularly checking whether security measures were effective.
David Doodson, the watchdog's head of investigations, said the password was not appropriate for protecting an account and described the incident as an example of how a weak password and an account that was no longer needed could leave the door open to a serious attack.
How did the account remain vulnerable for 12 years?
ONL created the test account in 2012 and protected it with ‘Password1’. According to the ICO, the account was not audited or removed for more than 12 years.
The watchdog also found that local administrator accounts were not reviewed after they were first deployed. Accounts on three affected systems had used the same password for the same period.
Data Cymru, which had contracted ONL to provide IT services, was found to have failed to identify and remove the dormant account or ensure it met stronger password requirements. It also had not put a data protection agreement in place with ONL, leaving a gap in responsibilities between the two organisations.
The ICO said the failures did not sit with one organisation alone.
Data Cymru merged with the Welsh Local Government Association (WLGA) in 2025. The WLGA said there was no evidence the stolen information had been shared further or misused.
What has changed since the attack?
Both organisations said they had strengthened their security arrangements following the incident.
ONL said it worked with Data Cymru within a week of the attack to check accounts across the network and disable those no longer needed. It also brought in independent cybersecurity specialists and introduced regular account reviews, stronger access controls and multi-factor authentication for remote access.
The company said the incident was limited to the server it hosted for Data Cymru and that no other customer information held by ONL was affected.
Data Cymru and ONL signed a data processing contract on April 30, 2025, while Data Cymru also introduced periodic account reviews and stronger access controls.
The WLGA said it remained committed to robust information governance and had strengthened arrangements for removing dormant accounts, password security, remote access and contractual responsibilities for security and audits.
The ICO urged organisations to use strong passwords, protect remote access with multi-factor authentication, regularly review user accounts and clearly establish who is responsible for cybersecurity when services are outsourced.
