The UK Information Commissioner's Office (ICO) has reprimanded Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru. The action follows a ransomware attack on 1 November 2024 that took the personal information of 3,300 people, most of them children. In its announcement on 20 October 2026, the regulator said the attackers got in through a test account called "Test2". That account had existed for more than 12 years and was protected throughout by the password "Password1". The ICO's notice is the only primary source for this incident. The other material in this source set is about Ogi in general or about separate Welsh and UK incidents, and none of it adds confirmed details about this breach.
What Happened
According to the ICO, the attack exploited the "Test2" account. The account had either stayed active since it was created more than 12 years earlier or had been reactivated by mistake before the incident. The regulator did not say which. The ICO checked "Password1" against a third-party password strength tool, which rated it "very weak" and said it could be cracked in under a second.
The ransomware encrypted 182.7GB of data and took 42GB from Data Cymru's systems. The ICO placed responsibility on both organisations. ONL created the test account. Data Cymru kept overall control of its network, including the power to tell ONL to create or remove accounts. In the ICO's words, "Neither had put in place sufficiently clear and effective measures to ensure that old accounts were routinely identified and removed."
The ICO notice does not name the ransomware group, say whether a ransom was demanded or paid, or explain why the reprimand came almost two years after the attack. None of the other sources fill those gaps.
What Was Taken
- Volume: 42GB taken from Data Cymru's systems, and 182.7GB encrypted in total (ICO).
- People affected: 3,300, the majority of them children (ICO). No other source gives a different figure.
- Nature of the data: The ICO says the compromised information related to "two projects supporting children and families." It did not name the projects or list the specific data fields.
Data about children connected to family support work is among the most sensitive personal data a public-sector body can hold. Without a field-level breakdown it is hard to judge the downstream risk, such as safeguarding exposure or targeted fraud. That gap is itself a finding.
Why It Matters
Supply chain responsibility is shared. The ICO's central point is that responsibility "did not sit with one organisation alone." The supplier created the account. The client had the authority to have it removed. Neither treated deprovisioning as its own job. Many UK public bodies run on managed service contracts, so the reprimand amounts to the regulator saying that unclear account ownership between client and provider is a compliance failure for both of them.
The provider sells security. FinTech Wales's 15 October 2026 profile of Ogi describes it as providing "cyber security and connectivity services to businesses," and Ogi's own recent marketing (Sophia Gardens, 9 September 2026) promotes managed network builds. Two LinkedIn profiles of current Ogi staff list security roles covering MFA, Conditional Access, and account security reviews, with start dates in 2024 and 2026. These are OTHER-tier sources. They show Ogi has a security function today. They do not say anything about Ogi's posture in November 2024, and they should not be read as evidence of what was fixed after the incident.
It is part of a run of Welsh public-sector incidents. In the same period, Dyfed-Powys Police reported a cyber incident identified on 14 September 2026 to the ICO (Info-Gov.uk), and Natural Resources Wales disclosed that a spreadsheet of employee diversity-monitoring data had been accidentally published (GBHackers). Neither is linked to the Data Cymru attack in any of the sources. Together they show steady pressure on Welsh public bodies' data handling.
The Attack Technique
The ICO confirms the initial access vector: a dormant or reactivated test account, "Test2", with the password "Password1". The regulator also stresses protecting "remote access with multi-factor authentication." That strongly suggests the account worked on an internet-facing remote access service without MFA, although the ICO did not name the service. Nothing in the sources shows whether the password was guessed through password spraying, found by credential stuffing, or obtained some other way. "Password1" falls to almost any spraying wordlist, so any of these would have worked.
One source could be misread as related. Security Affairs (11 September 2026) reports a mass-exploitation campaign against SonicWall SMA1000 appliances using CVE-2026-15409, a pre-authentication SSRF flaw with a CVSS score of 10.0. Hunt.io links that campaign, with moderate confidence, to the July 2026 attack on the Borough Council of King's Lynn and West Norfolk. That activity began in July 2026, about 20 months after the Data Cymru attack, and no source connects the two. Accounts of the Data Cymru intrusion point to weak credentials, not exploitation of a vulnerability.
What Organizations Should Do
- Hunt for test, service, and orphaned accounts now. List every enabled account that has had no interactive owner or login for 90 days or more. Names like "test", "temp", "demo", or "admin" followed by a number deserve particular attention. Disable them first and delete them once confirmed.
- Ban known-weak passwords outright. Check every password against breached-password and common-password lists, using Entra ID Password Protection, Specops, or an equivalent. "Password1" meets most legacy complexity rules, which shows that complexity rules alone don't stop weak passwords.
- Require MFA on all remote access, with no exceptions. That covers VPN, VDI, RDP gateways, and web portals. Test and service accounts must not be exempt. Accounts that cannot do MFA should not be reachable from the internet.
- Write account ownership into supplier contracts. Make it explicit who creates accounts, who approves them, who reviews them, and who removes them. Require providers to declare every account they create, and run joint access reviews at least quarterly.
- Alert on reactivation. Treat re-enabling a long-dormant account as a high-fidelity detection, along with the first remote login from an account that has never used remote access.
- Segment and minimise sensitive datasets. Data about children's services projects should sit behind separate access controls, and data that is no longer needed should be deleted. That limits how much a single compromised account can reach.
Sources: “'Password1’ is not an appropriate password”: Two Welsh organisatio... | UK Council Attack Linked to Mass Exploitation of SonicWall Flaw | Howzat for connectivity? Powering Sophia Gardens - Ogi | Eseosa Idahor | Martin van Tongerlo | Welsh police force investigating whether staff data was compromised... | Ogi Brings Welsh Sports Teams Together for The Big Welsh Switch - F... | Natural Resources Wales Data Breach Exposes Sensitive Employee Dive...