ICO reprimands two Welsh organisations – including local government company – after cyber

Following the investigation, the watchdog described the use of ‘Password 1’ for a test account as “a wide-open door to nefarious actors” - warning that organisations should remove accounts that are no longer required, and block “weak and commonly used passwords”.

During the attack, the personal information of 3,300 people was taken, the majority of whom were children.

The ICO investigation found that the attack exploited a test account, known as ‘Test2’, that had existed for more than 12 years and had either remained active since it was created or been inadvertently reactivated before the incident.

It was found that throughout this period, the ‘Test2’ account was protected by the password ‘Password1’, which, when checked against a third-party password strength tool, was classified as ‘very weak’ and could be compromised in less than a second.

The ransomware attack took place on 1 November 2024 and encrypted 182.7GB of data, with 42GB of data being taken from Data Cymru’s systems.

The compromised information related to two projects supporting children and families.

During the investigation, the ICO found that Data Cymru – which is funded and wholly owned by local government in Wales and whose board of directors is elected annually by the Welsh Local Government Association – infringed Articles 28(4), 32(1)(b) and 32(1)(d) of the UK GDPR.

In particular, Data Cymru:

“did not have a contract in place with ONL containing the legally mandated data protection terms required when appointing a sub-processor;

did not clearly document how the Active Directory services provided by ONL would be delivered, monitored or audited, creating a gap in the allocation of responsibilities between the two organisations;

failed to ensure that the dormant ‘Test2’ account was identified and removed or updated to comply with enhanced password requirements it subsequently introduced; and

conducted account reviews that were not scheduled or routine and did not cover the full contents of Active Directory.”

Meanwhile, the watchdog found that ONL infringed Articles 32(1)(b) and 32(1)(d) of the UK GDPR by “failing to implement appropriate measures to maintain the confidentiality and integrity of its processing systems and by failing to regularly test and evaluate whether its security measures were effective”.

The ICO found that ONL created the ‘Test2’ account in January 2012 with the password ‘Password1’ and did not apply appropriate password-strength and complexity requirements to it.

It also failed to conduct regular audits of accounts it had created within Data Cymru’s network, “allowing the operationally unnecessary test account to remain in existence for more than 12 years”.

Highlighting the importance of “basic account management” and “clear oversight of outsourced services” going forward, the ICO recommended organisations:

Remove accounts that are no longer required: Test, dormant and former-user accounts should be routinely identified and deactivated.

Block weak and commonly used passwords: Password controls should prevent easily guessed credentials such as ‘Password1’ from being used.

Protect remote access: Multi-factor authentication should be applied to remote access services by default.

Audit the whole account environment: Reviews should cover all relevant accounts, permissions and security groups, not just a limited subset.

Avoid shared administrative credentials: Privileged accounts should use unique credentials so that one compromised system does not provide access to others.

Define responsibilities in contracts: Agreements with IT providers and sub-processors should clearly explain how security controls will be delivered, monitored and audited, and include all legally mandated provisions.

David Doodson, Head of Investigations at the ICO, said: “Password1 is not an appropriate password, it is a wide-open door to nefarious actors.

"This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands.

“The responsibility for these failures did not sit with one organisation alone. ONL created the test account whilst Data Cymru retained overall control of its network, including the ability to instruct ONL to create or remove accounts. Neither had put in place sufficiently clear and effective measures to ensure that old accounts were routinely identified and removed.”

He added: “The lesson for every organisation is straightforward: use strong passwords, protect remote access with multi-factor authentication, regularly review every user account, and be completely clear who is responsible for cyber security when services are outsourced. Basic cyber security controls are not optional, and the negative consequences of not having them can be severe.”

A WLGA Spokesperson said: “We accept the ICO’s reprimand and take its findings seriously. The reprimand relates to a ransomware attack on Data Cymru’s systems in November 2024.

“The incident occurred when Data Cymru was a separate organisation. Data Cymru has subsequently merged with the WLGA, with its staff and functions having been transferred into the Association in 2025.

“The WLGA has long-established processes in place for reporting, assessing and managing data protection incidents, overseen through its data protection arrangements.

“There is no evidence to indicate that the compromised information was shared further or misused.

“We recognise the fundamental importance of strong information governance and of protecting the information entrusted to organisations working on behalf of local government."

The spokesperson added: “Since the incident, measures have been put in place to strengthen the arrangements identified by the ICO, including the removal of dormant user accounts, strengthened password and remote user access controls, and improved data processing arrangements to clearly define contractual responsibilities for security and audit activities.

“We remain committed to maintaining robust information governance standards and continually reviewing the measures we have in place.”

A spokesperson for Ogi Networks Limited said: “We provided IT services to Data Cymru, and a test account set up on its network in 2012 should have been removed long before criminals were able to use it. We accept the Information Commission’s findings, and we’ve acted on them.

“Within a week of the attack, we’d worked with Data Cymru to check every account on its network and switched off the ones it no longer needed that same day. We also brought in independent cyber security specialists to investigate. Since then, we’ve protected remote access with multi-factor authentication and introduced regular account reviews for the customers whose networks we look after, so accounts that aren’t needed are found and removed.

“This was limited to the server we hosted for Data Cymru. No other customer information held by ONL was affected.”