A cyber-attack that compromised the personal information of 3,300 people, predominantly children, exploited a test account protected by the notoriously weak password "Password1", according to findings by the Information Commissioner's Office (ICO). The breach occurred on 1 November 2024 when hackers accessed systems operated by Ogi Networks Limited (ONL) and Data Cymru, a Welsh organisation supporting children and families. According to BBC News, the ICO has reprimanded both organisations for failing to implement adequate security safeguards and for neglecting to regularly audit their protective measures.
The compromised account, designated Test2, had remained active and unreviewed for more than 12 years despite no longer serving a legitimate business purpose. During the ransomware attack, intruders encrypted 182.7 gigabytes of data and extracted 42 gigabytes from Data Cymru's infrastructure, exposing sensitive information linked to two initiatives serving children and families. The ICO issued reprimands to both organisations on 14 October 2026, finding them in breach of UK GDPR regulations.
How did the attackers gain access?
ONL created the Test2 account on 13 January 2012, likely to evaluate user access procedures before deploying systems with genuine user data. The password protecting this account—"Password1"—could be cracked in less than a second using standard cryptographic techniques. Once attackers gained access to one system through this compromised account, they were able to collect and reuse local account hashes to authenticate to other systems, as three affected servers shared an identical local administrator password. This lateral movement capability allowed the breach to expand across multiple systems within the network.
ONL failed to audit the Test2 account or remove it throughout the entire 12-year period following its creation. The company also neglected to review local administrator accounts after their initial deployment, leaving credentials unchanged across all three compromised systems for the same duration. These oversights persisted for more than six years after ONL's obligations under GDPR came into effect in May 2018.
What were the regulatory failures?
The ICO identified multiple governance and security deficiencies across both organisations. Data Cymru had not established a formal data protection agreement with ONL, creating ambiguity about which entity bore responsibility for specific security functions. Additionally, Data Cymru failed to identify and either remove the dormant Test2 account or upgrade its password to meet contemporary security standards.
The ICO found that Data Cymru's account reviews were unscheduled and reactive rather than routine and systematic, and did not encompass all accounts within Active Directory, the centralised system managing user access across the network. The organisations had also failed to document clearly how ONL's Active Directory services would be monitored and audited, leaving a critical gap in oversight.
David Doodson, head of investigations at the Information Commissioner's Office, characterised the security failures as emblematic of broader organisational negligence.
Password1 is not an appropriate password, it is a wide-open door to nefarious actors. This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands.Doodson emphasised that accountability for the breach extended beyond a single entity, stating that
the responsibility for these failures did not sit with one organisation alone.
What remedial steps have been taken?
Following the attack, both organisations implemented strengthened security protocols. ONL introduced a systematic process requiring customers to conduct periodic reviews of active user accounts and receive recommendations regarding accounts that should be deactivated. The company also enhanced access controls by deploying multi-factor authentication, which requires users to verify their identity through multiple methods before gaining system access.
Data Cymru similarly introduced periodic account reviews and upgraded its access controls to include multi-factor authentication. Critically, on 30 April 2025, the two organisations formalised their relationship by entering into a legally compliant data processing contract, establishing clear contractual obligations regarding data protection responsibilities.
A spokesperson for ONL provided additional detail about the immediate response to the breach.
Within a week of the attack, we'd worked with Data Cymru to check every account on its network and switched off the ones it no longer needed that same day. We also brought in independent cyber-security specialists to investigate.The spokesperson added that
since then, we've protected remote access with multi-factor authentication and introduced regular account reviews for the customers whose networks we look after, so accounts that aren't needed are found and removed. This was limited to the server we hosted for Data Cymru. No other customer information held by ONL was affected.
What are the broader lessons?
The ICO has used the incident to issue guidance applicable to all organisations handling personal data. The watchdog recommended that all entities adopt strong passwords that resist rapid decryption, protect remote access through multi-factor authentication, conduct regular reviews of every user account to identify and remove unnecessary access, and establish unambiguous responsibility frameworks when cyber-security functions are delegated to external service providers.
This breach reflects a pattern of security incidents affecting organisations across the United Kingdom. The Department for Education in England experienced a cyber-attack resulting in the theft of approximately 607,000 records, while parents of children at 16 additional Northern Ireland schools were warned of possible data breaches following a cyber-attack on the C2k school network. These incidents underscore the vulnerability of organisations managing sensitive information about children and families to sophisticated cyber threats.
Key Facts
- A test account protected by the password "Password1" remained active and unaudited for more than 12 years, enabling the breach of 3,300 people's records on 1 November 2024
- Attackers encrypted 182.7 gigabytes of data and extracted 42 gigabytes from Data Cymru's systems, exposing information related to two child and family support projects
- The ICO found both organisations in breach of UK GDPR for failing to implement adequate security measures and neglecting to regularly review their protective controls
- Both organisations have since implemented multi-factor authentication, periodic account reviews, and formalised their data protection responsibilities through a legally compliant contract signed on 30 April 2025
