How a 12-Year-Old Test Account and 'Password1' Exposed Children's Data

On October 20, 2026, the UK Information Commissioner's Office (ICO) published a reprimand over a ransomware attack on Data Cymru, the Local Government Data Unit for Wales. The attack happened in November 2024, but the findings are a textbook example of how small hygiene gaps become serious breaches.

Data Cymru is a Welsh government-funded body that helps councils and other organizations work with data. Its third-party IT provider, Ogi Networks Limited (ONL), had served it since 2012.

• Attackers got in through a test account called "Test 2" that had existed for more than 12 years.
• Its only protection was the password "Password1".
• Before deploying ransomware, they stole 42GB from a primary domain controller, a file server and an SQL server.
• They then encrypted 182.7GB on file servers and an internal SQL database server.
• The stolen data related to two projects supporting children and families in Wales. Personal data of 3,300 people, most of them children, was affected.

The article reporting the ICO's findings does not name the ransomware group responsible.

The ICO concluded that both organizations breached UK GDPR:

• ONL failed to enforce password requirements, did not audit the accounts it created, and did not review local administrator accounts.
• Data Cymru did not have a contract with the required data protection terms, and its account reviews were unscheduled and incomplete.

Neither organization was fined. Both received reprimands. ONL has since strengthened its account access controls, and the two organizations have signed a compliant data processing contract.

This was not a sophisticated attack. It was a chain of ordinary, avoidable gaps:

1. 01Test and temporary accounts become permanent. Anything created "just for testing" needs an owner and an expiry date.
2. 02Weak passwords on forgotten accounts are the easiest way in. Nobody notices them, so nobody fixes them.
3. 03Nobody owned the review. Reviews that are "unscheduled and incomplete" are the same as no reviews.
4. 04Responsibility was blurred. When an IT provider runs your systems, your contract must spell out who handles account management, password policy and data protection, and you still need to check that it happens.
5. 05Children's data raises the stakes. Regulators and the public expect extra care.

You can start this week:

• List all accounts in your directory, including service, test, vendor and local admin accounts.
• Flag anything unused for 90+ days, anything with no named owner, and anything with a non-expiring password.
• Disable first, then delete, so you can spot anything that breaks.
• Enforce a password policy that blocks common passwords, and require MFA on all remote and admin access.
• Schedule recurring reviews, put them on a calendar and assign a person, not a team.
• If a provider manages your IT, ask for evidence of account audits, not just assurances.

We run identity and access audits, clean up dormant accounts and help organizations structure supplier agreements around security responsibilities. Contact us.