News · Regulation · Breaking

ICO reprimands Data Cymru and Ogi after "Password1" test account exposed data of 3,300 people, mostly children

The ICO has reprimanded Wales' local government data unit Data Cymru and its IT provider Ogi Networks after attackers used a 12-year-old test account protected by "Password1" to reach the data of 3,300 people, most of them children.

What happened

The Information Commissioner's Office (ICO) has reprimanded Ogi Networks Limited (ONL) and Data Cymru, the local government data unit for Wales, for breaching UK GDPR after cyber criminals accessed the personal information of 3,300 people, The Independent reported on 20 October 2026.

Most of the data related to children, because the compromised information came from two projects supporting families.

According to the ICO, the attackers got in through a test account called "Test 2", set up by ONL on Data Cymru's network in January 2012. It was protected only by the password "Password1", which a third-party strength checker classed as "very weak" and crackable in under a second. More than 180GB of data was taken in a ransomware attack, 42GB of it from Data Cymru's systems.

What the ICO found

• Ogi Networks did not apply password strength requirements to the test account and did not regularly audit accounts it had created on Data Cymru's network. The "operationally unnecessary" account existed for more than 12 years, including more than six years after ONL's GDPR obligations took effect.
• Accounts on three affected systems had kept the same password for more than 12 years, because local administrator accounts were never reviewed after deployment.
• Data Cymru had no contract with ONL containing the legally required data protection terms, and did not make sure the dormant account was found and removed, or updated to meet later password rules.

David Doodson, head of investigations at the ICO, said: "This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands." He added that responsibility "did not sit with one organisation alone".

The response

Both organisations have since signed a compliant data processing contract and strengthened account reviews, with multi-factor authentication on remote access. Ogi said it accepted the findings, checked every account on Data Cymru's network within a week of the attack, switched off unneeded accounts and brought in independent specialists. It said the incident was limited to the server it hosted for Data Cymru.

Why this matters

This was not a sophisticated attack. It was a forgotten account, left reachable for more than a decade, with a password anyone could guess. The ICO's point about shared responsibility matters just as much: when a supplier runs part of your network, someone still has to own the question of what is connected and who can reach it.

The ICO's own lesson is straightforward: use strong passwords, protect remote access with multi-factor authentication, review every account regularly and be clear who is responsible when services are outsourced.

There is a wider principle too. Anything that stays permanently connected, including sensitive records nobody is actively using, stays within reach of the next forgotten account. Offline Secure Storage® from Firevault keeps dedicated copies of sensitive data physically disconnected by default, reachable only through an authorised, identity-verified session. It does not replace good account hygiene, but it removes the standing network path to the data that matters most.

Source: The Independent, "Cyber attackers breached children's data through 'very weak' password", 20 October 2026, reporting the ICO's reprimand.

Sources and reporting notes

1. independent.co.ukPrimary reporting referenced in this analysis.

Incident facts are attributed to the named sources; the recommendations and product discussion are Firevault analysis by Mark Fermor.