The UK Information Commissioner’s Office has issued reprimands to Data Cymru and its IT provider Ogi Networks Limited after a ransomware attack that began with a forgotten test account protected by the password “Password1.” The attack, which took place on November 1, 2024, exposed personal data on 3,300 people, most of them children. The ICO published the reprimands on Tuesday and did not impose fines.
A Test Account Named Test2 Opened the Door
The intruder entered through a test account called “Test2.” The account was created in January 2012 and was still active at the time of the attack. Its password, “Password1,” was rated as one that could be cracked in under a second.
Data Cymru is the Local Government Data Unit for Wales. Ogi Networks Limited is its IT provider. The ICO reprimanded both organizations.
Weak Local Administrator Passwords on Three Systems
The regulator also noted weak passwords on local administrator accounts on the three systems the attacker affected. Those systems were a domain controller, a file server and an SQL server, which together held the data the attacker took.
42 GB Stolen and 182.7 GB Encrypted
Before deploying ransomware, the attacker exfiltrated 42 GB of data from a domain controller, a file server and an SQL server. The attacker then encrypted 182.7 GB across a file server and an SQL server.
Data From Two Projects Supporting Children and Families
The data covered two projects that support children and families. It included personal data on 3,300 people, mostly children. The material reported does not specify the categories of personal data involved.
ICO Chooses Reprimands Over Fines
The ICO issued reprimands rather than monetary penalties. A reprimand is a formal expression of the regulator’s findings and does not carry a financial sanction. The decision applies to both Data Cymru and Ogi Networks, which the regulator treats as responsible for the failures it identified.
The case turns on three details that the ICO’s findings put on the record. The account was created in January 2012 and was still in place when the attack occurred in November 2024, a period of nearly 13 years. Its password was a common string that the findings rate as crackable in under a second. And the same intrusion reached three separate systems, where the attacker first took 42 GB and then encrypted 182.7 GB.
The pairing of Data Cymru and Ogi Networks in the reprimands reflects the arrangement between a public-sector data unit and its IT provider. The ICO directed its findings at both organizations, without a fine for either.
Timeline: From a 2012 Account to a 2026 ICO Reprimand
The test account dates to January 13, 2012. The ransomware attack happened on November 1, 2024. The ICO’s enforcement action became public on October 20, 2026, nearly two years after the attack. The news event is the enforcement action, not a new breach.
The case shows how a single account left unused for years can provide access to multiple core systems at once. The same account reached a domain controller, a file server and an SQL server, so the attacker could collect data from each before encrypting files. The ICO’s findings tie the incident to two separate password failures: the credentials on the test account, and the credentials on the local administrator accounts across the three systems.
The ICO’s reprimand route is the regulator’s formal way of recording findings without a monetary penalty. In this case it covers an IT provider and the public-sector data unit it served, and it follows a breach in which the attacker exfiltrated data before encrypting it, a sequence that left the 3,300 affected people exposed to disclosure of their information in addition to losing access to the systems that held it. The reporting does not say whether the stolen data was published.
For organizations that hold data on children, the case is a concrete example of what the ICO treats as a basic failing. Both organizations received formal findings on the public record, and no financial penalty accompanied them, which leaves the reprimand as the only consequence the regulator has announced.
