The Information Commissioner’s Office in the United Kingdom has formally reprimanded IT service provider Ogi Networks Limited and public sector body Data Cymru after a ransomware attack compromised the personal information of roughly 3,300 people, the majority of whom were children. An official inquiry revealed that the breach, which occurred on November 1, 2024, succeeded because cybercriminals gained entry via an obsolete test account secured by the easily guessable credential “Password1”. Attackers encrypted approximately 182.7 gigabytes of data and exfiltrated roughly 42 gigabytes of sensitive files tied to community projects supporting children and families.
Dormant Test Profile Remained Active for Over a Decade
Investigators established that Ogi Networks created a test account designated “Test2” in 2012, assigning it the rudimentary password “Password1” before leaving it active without administrative oversight for over 12 years. The vulnerability was compounded across the infrastructure, as local administrator accounts on three affected systems relied on the same static credential over an extended period without undergoing mandatory security audits. The regulatory findings established that leaving unmonitored test accounts active provides an effortless entry point for cyber adversaries, regardless of whether the systems serve day-to-day operations.
David Doodson, head of investigations at the data watchdog, stated that relying on “Password1” was an unacceptable security practice that left network assets exposed to external threat actors. The inquiry concluded that both entities violated the UK General Data Protection Regulation by failing to deploy effective safeguards. Regulators highlighted that Data Cymru had neglected to establish a formal data processing agreement with its IT vendor and criticized both organizations for failing to maintain clear demarcations of technical and governance responsibilities.
Remediation and Account Purges Implemented Following Attack
Following the compromise, Ogi Networks accepted the regulatory findings and enlisted independent cybersecurity investigators to examine the extent of the infiltration. Within a week of the incident, technicians conducted an audit across the network to identify and disable all redundant user profiles, subsequently introducing multi-factor authentication and strict access controls. Ogi Networks confirmed that the intrusion remained confined to the server hosting Data Cymru’s assets and did not spill over into environments belonging to its other commercial clients.
Data Cymru executed a formal data processing agreement with Ogi Networks on April 30, 2025, to bring their contractual arrangements into compliance with regulatory standards. Data Cymru subsequently merged into the Welsh Local Government Association in 2025, which confirmed that internal security reviews found no indication that the exfiltrated records had been shared publicly or exploited. The regional body introduced updated information governance protocols, including mandatory account reviews, elevated password complexity standards, and formal audit routines to govern external technology contractors.
Regulatory Authorities Call for Routine Credential Audits
The enforcement action highlighted systemic risks associated with outsourcing core technology services without continuous oversight. The Information Commissioner’s Office noted that transferring infrastructure management to a third party does not absolve organizations of their underlying statutory responsibilities to safeguard personal data. Regulators urged public and private bodies to enforce multi-factor authentication on all remote access pathways, restrict administrative privileges, and eliminate inactive user accounts before they can be leveraged in cyberattacks.
The watchdog emphasized that even modest administrative oversights, such as neglecting to decommission a deprecated test account or enforcing basic password requirements, can expose sensitive public records to significant harm. For bodies managing sensitive files involving vulnerable populations, rigorous vendor contracting, continuous log monitoring, and stringent credential policies remain essential requirements to avoid regulatory penalties and severe data breaches.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
