Data Cymru: ransomware through a ‘Password1’ test account

The Information Commissioner’s Office (ICO), the UK data protection authority, published two reprimands on 20 October 2026 over a ransomware attack in November 2024. They are addressed to Ogi Networks Limited (ONL), a Welsh network operator, and to the Local Government Data Unit – Wales, known as Data Cymru, the body funded by the Welsh government that helps councils and other public bodies collect and analyse data. According to the sources, personal data on about 3,300 people, most of them children, was stolen.

The entry point is mundane, and that is what makes it instructive: a test account created in 2012 and never removed, with the password “Password1”. The information below comes from the ICO documents as reported by The Register and Infosecurity Magazine; DataBreaches.net confirms the main facts.

What happened

ONL has been Data Cymru’s external IT provider since 2012: according to the ICO, as quoted by The Register, it provides servers, connectivity, licensing and support. On 13 January 2012, during its first project for Data Cymru, ONL created an account called “Test2” (“Test 2” in Infosecurity Magazine’s account), probably to test user access before migrating the real users. The account was given the password “Password1” and stayed active for more than 12 years without serving any purpose.

On 1 November 2024, according to The Register, an attacker used that account to get into Data Cymru’s network. Before starting encryption, the attacker exfiltrated 42 GB of data from a primary domain controller, a file server and an SQL server; then encrypted 182.7 GB on a file server and an internal database server. According to Infosecurity Magazine, the stolen data related to two projects supporting children and families in Wales.

The sources do not name the ransomware group, say how the attacker obtained or guessed the password, or whether the account was reachable through a remote access service.

Technical details

• Initial access with a forgotten valid account. “Test2” had no operational purpose and a password that the strength tool cited by the ICO rates as “very weak”, crackable in under a second. According to the ICO, ONL had no procedures to periodically review the accounts it had created in Data Cymru’s Active Directory.
• Lateral movement with local passwords. The local administrator accounts on the three affected systems all had the same password, set in January 2012 and never changed for more than twelve and a half years. Once one system was breached, the attacker could collect the local account hashes and use them to authenticate to the others: the pattern known as pass-the-hash. ONL confirmed to the ICO that it never reviewed those accounts after deployment.

An indicative MITRE ATT&CK mapping, ours and not the sources’: T1078 (Valid Accounts) for the entry, T1003 (OS Credential Dumping) and T1550.002 (Pass the Hash) for lateral movement, exfiltration before encryption, and T1486 (Data Encrypted for Impact). No indicators of compromise have been published.

The ICO’s findings

ONL was reprimanded for breaching Article 32 of the UK GDPR (security of processing): no strength requirements applied to the account’s password, no periodic review of the accounts created in the customer’s network, no review of local administrators after initial deployment.

According to Infosecurity Magazine, the ICO found that Data Cymru had no contract with ONL containing the data protection terms required by law for anyone processing data on another’s behalf, and that its account reviews were neither scheduled nor extended to the whole Active Directory. Data Cymru, the ICO notes, still controlled its own network and could instruct ONL to create or remove accounts: responsibility lay with both.

No fine was issued: the ICO took into account the measures taken after the attack, including tighter access controls at ONL and a compliant data processing contract between the two organisations.

Impact for European and Italian organisations

No vulnerability to patch, but practices found everywhere: forgotten test accounts, identical local passwords on several servers, providers administering the customer’s network without clear roles.

The same rules apply in the EU: Article 32 of the EU GDPR requires appropriate security measures that are tested over time, and Article 28 a contract with every processor. For NIS2 entities (in Italy, Legislative Decree 138/2024), including public bodies and many managed IT service providers, access control, multi-factor authentication and supply chain security are explicit measures.

What to do now

1. Hunt for unnecessary accounts in Active Directory: test and project accounts, accounts of former providers, accounts never used or with no logons for months. Disable them, then delete them.
2. Run periodic, complete account reviews on a schedule, across the whole directory and not only known users.
3. Make local administrator passwords unique on every machine, with automatic rotation (for example with Windows LAPS), and restrict network logons with local accounts.
4. Enforce a password policy that blocks common and already breached passwords, technical accounts included.
5. Protect all remote access with multi-factor authentication, provider accounts included.
6. Put responsibilities in writing with whoever manages your network: data processing agreement, who creates and who removes accounts, and how this is checked.
7. Watch for anomalous access: dormant accounts coming back to life, local account logons from one machine to another, unusual data transfers from servers.

How ARXDOME helps

ARX Sentry collects security events from computers and servers and, in its identity pages, shows logons, failures, privileged access, remote desktop, night-time logons and account changes, with an event family for explicit credential use. ARX Shield checks machine configuration against the CIS benchmarks and can isolate a suspicious machine from the network. ARX Expose flags company accounts involved in known breaches.

Last updated: 21 October 2026