--- title: "ICO reprimands Data Cymru and Ogi after \"Passwo… | Firevault" url: https://fire-vault.com/news/ico-reprimand-data-cymru-ogi-password1-test-account-2026 description: "The ICO has reprimanded Wales' local government data unit Data Cymru and its IT provider Ogi Networks after attackers used a 12-year-old test account…" lang: en-GB --- Breaking News Updated as information becomes available News · Regulation · Breaking # ICO reprimands Data Cymru and Ogi after "Password1" test account exposed data of 3,300 people, mostly children The ICO has reprimanded Wales' local government data unit Data Cymru and its IT provider Ogi Networks after attackers used a 12-year-old test account protected by "Password1" to reach the data of 3,300 people, most of them children. **Mark Fermor**CTO, CMO and Founder, Firevault Published 20 October 2026 · 3 min read Share LinkedIn (https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fico-reprimand-data-cymru-ogi-password1-test-account-2026)Email A dark server room with a login screen and an old, dusty network switch ## What happened The Information Commissioner's Office (ICO) has reprimanded Ogi Networks Limited (ONL) and Data Cymru, the local government data unit for Wales, for breaching UK GDPR after cyber criminals accessed the personal information of 3,300 people, The Independent reported on 20 October 2026. Most of the data related to children, because the compromised information came from two projects supporting families. According to the ICO, the attackers got in through a test account called "Test 2", set up by ONL on Data Cymru's network in January 2012. It was protected only by the password "Password1", which a third-party strength checker classed as "very weak" and crackable in under a second. More than 180GB of data was taken in a ransomware attack (https://fire-vault.com/threats/ransomware), 42GB of it from Data Cymru's systems. ## What the ICO found - **Ogi Networks** did not apply password strength requirements to the test account and did not regularly audit accounts it had created on Data Cymru's network. The "operationally unnecessary" account existed for more than 12 years, including more than six years after ONL's GDPR obligations took effect. - Accounts on three affected systems had kept the **same password for more than 12 years**, because local administrator accounts were never reviewed after deployment. - **Data Cymru** had no contract with ONL containing the legally required data protection terms, and did not make sure the dormant account was found and removed, or updated to meet later password rules. David Doodson, head of investigations at the ICO, said: "This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands." He added that responsibility "did not sit with one organisation alone". ## The response Both organisations have since signed a compliant data processing contract and strengthened account reviews, with multi-factor authentication on remote access. Ogi said it accepted the findings, checked every account on Data Cymru's network within a week of the attack, switched off unneeded accounts and brought in independent specialists. It said the incident was limited to the server it hosted for Data Cymru. ## Why this matters This was not a sophisticated attack. It was a forgotten account, left reachable for more than a decade, with a password anyone could guess. The ICO's point about shared responsibility matters just as much: when a supplier runs part of your network, someone still has to own the question of what is connected and who can reach it. The ICO's own lesson is straightforward: use strong passwords, protect remote access with multi-factor authentication, review every account regularly and be clear who is responsible when services are outsourced. There is a wider principle too. Anything that stays permanently connected, including sensitive records nobody is actively using, stays within reach of the next forgotten account. Offline Secure Storage (https://fire-vault.com/offline-secure-storage)® from Firevault keeps dedicated copies of sensitive data physically disconnected by default, reachable only through an authorised, identity-verified session. It does not replace good account hygiene, but it removes the standing network path to the data that matters most. _Source: The Independent, "Cyber attackers breached children's data through 'very weak' password", 20 October 2026, reporting the ICO's reprimand._ ## Questions Attackers used a test account created in 2012 and protected only by "Password1" to access the personal data of 3,300 people, most of them children. The ICO found failures in password controls, account reviews and data processing contracts. More than 180GB was taken in a ransomware attack, 42GB of it from Data Cymru's systems, according to the ICO. Use strong passwords, protect remote access with multi-factor authentication, regularly review every user account and be clear who is responsible for cyber security when services are outsourced. ## Sources and reporting notes 1. independent.co.uk (https://www.independent.co.uk/news/uk/home-news/cyber-attack-data-breach-password-onl-data-cymru-ico-b3069945.html)Primary reporting referenced in this analysis. Incident facts are attributed to the named sources; the recommendations and product discussion are Firevault analysis by Mark Fermor. About the author **Mark Fermor** CTO, CMO and Founder of Firevault. Mark writes on physical control, offline storage and the incidents that show why both matter. ## More regulation - Threat Analysis · 22 Oct 2026**PHP2Shell: critical PHP vulnerability forces websites offline worldwide**_Read the analysis_: https://fire-vault.com/news/php2shell-critical-php-vulnerability-websites-offline-2026 - Breach Analysis · 21 Oct 2026**State Bank of India confirms data loss after 3,897 customer records found on the dark web**_Read the analysis_: https://fire-vault.com/news/sbi-confirms-data-breach-customer-records-dark-web-2026 - Breach Analysis · 21 Oct 2026**Cyberattack on cloud provider Arcadia may expose data of 125,000 Japanese police officers and staff**_Read the analysis_: https://fire-vault.com/news/arcadia-cyberattack-japan-police-data-breach-2026 - Threat Intelligence · 16 Oct 2026**GhostAction returns: about 1,900 GitHub accounts used to target more than 30,000 repositories**_Read the analysis_: https://fire-vault.com/news/ghostaction-github-actions-supply-chain-attack-october-2026 - Breach Analysis · 15 Oct 2026**EY data breach: client tax records exposed through a support platform**_Read the analysis_: https://fire-vault.com/news/ey-data-breach-client-tax-records-october-2026 - Insight · 15 Oct 2026**CEOs now rank cyber as the top risk to growth. What should they buy first?**_Read the analysis_: https://fire-vault.com/news/kpmg-ceo-outlook-2026-cybersecurity-top-risk-to-growth Back to the Knowledge Vault: https://fire-vault.com/learn/knowledge Why #OSS ### Keep a clean copy out of reach. Offline Secure Storage® keeps one copy physically disconnected at the hardware level between sessions. Why #OSS: https://fire-vault.com/why-oss Control ### Govern the paths attackers depend on. Physical, out-of-band control of selected network paths, composed into ten Blueprints. Explore Control: https://fire-vault.com/control Image: Vault (https://fire-vault.com/__l5e/assets-v1/b9413e6e-5b45-442d-ab80-67cf0c578ba6/oss-approved-vault.png) Ready to start? ### Create your Vault online. Business Vaults from £360 a month inc VAT, on a 36-month commitment. Get started: https://fire-vault.com/get-started Book a demo: https://fire-vault.com/demo ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/ico-reprimand-data-cymru-ogi-password1-test-account-2026#webpage", "url": "https://fire-vault.com/news/ico-reprimand-data-cymru-ogi-password1-test-account-2026", "name": "ICO reprimands Data Cymru and Ogi after \"Passwo…", "description": "The ICO has reprimanded Wales' local government data unit Data Cymru and its IT provider Ogi Networks after attackers used a 12-year-old test account…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/ico-data-cymru-ogi-password1-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/ico-reprimand-data-cymru-ogi-password1-test-account-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/ico-reprimand-data-cymru-ogi-password1-test-account-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "ICO reprimands Data Cymru and Ogi after \"Password1\" test account exposed data of 3,300 people, mostly children", "item": "https://fire-vault.com/news/ico-reprimand-data-cymru-ogi-password1-test-account-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "ICO reprimands Data Cymru and Ogi after \"Password1\" test account exposed data of 3,300 people, mostly children", "description": "The ICO has reprimanded Wales' local government data unit Data Cymru and its IT provider Ogi Networks after attackers used a 12-year-old test account protected by \"Password1\" to reach the data of 3,300 people, most of them children.", "url": "https://fire-vault.com/news/ico-reprimand-data-cymru-ogi-password1-test-account-2026", "image": [ { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/ico-data-cymru-ogi-password1-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/ico-data-cymru-ogi-password1-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/ico-data-cymru-ogi-password1-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/ico-data-cymru-ogi-password1-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-10-20T15:02:17+00:00", "dateModified": "2026-10-21T08:45:19.335849+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/ico-reprimand-data-cymru-ogi-password1-test-account-2026" }, "inLanguage": "en-GB", "articleSection": "Regulation", "wordCount": 533, "keywords": "Regulation, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "## What happened The Information Commissioner's Office (ICO) has reprimanded Ogi Networks Limited (ONL) and Data Cymru, the local government data unit for Wales, for breaching UK GDPR after cyber criminals accessed the personal information of 3,300 people, The Independent reported on 20 October 2026. Most of the data related to children, because the compromised information came from two projects s", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Why did the ICO reprimand Data Cymru and Ogi Networks?", "acceptedAnswer": { "@type": "Answer", "text": "Attackers used a test account created in 2012 and protected only by \"Password1\" to access the personal data of 3,300 people, most of them children. The ICO found failures in password controls, account reviews and data processing contracts." } }, { "@type": "Question", "name": "How much data was taken?", "acceptedAnswer": { "@type": "Answer", "text": "More than 180GB was taken in a ransomware attack, 42GB of it from Data Cymru's systems, according to the ICO." } }, { "@type": "Question", "name": "What does the ICO advise other organisations to do?", "acceptedAnswer": { "@type": "Answer", "text": "Use strong passwords, protect remote access with multi-factor authentication, regularly review every user account and be clear who is responsible for cyber security when services are outsourced." } } ] } ] ```