ICO Penalizes Data Cymru and ONL for Weak Password Breach Exposing Children’s Data
UK regulator reprimands Welsh data unit and IT provider after ransomware attackers used a simple password to steal thousands of records.
Key points
- The ICO found that a test account protected only by the password 'Password1' allowed ransomware access to Data Cymru’s network in November 2024.
- Attackers exfiltrated 42GB of data and encrypted 182.7GB, compromising personal details of 3,300 people, mostly children, in Wales.
- Both Data Cymru and its IT provider, Ogi Networks Limited, violated UK GDPR by failing to audit accounts or enforce password complexity.
The UK Information Commissioner’s Office has issued formal reprimands to Data Cymru and its IT service provider, Ogi Networks Limited, following a ransomware attack in November 2024. The investigation revealed that attackers gained initial network access through a dormant test account secured only by the password ‘Password1’. This weak credential served as the entry point for the cyber intrusion that compromised sensitive personal data.
According to Infosecurity Magazine, the threat actors exploited the ‘Test 2’ account, which had existed for more than 12 years without proper oversight. Once inside, the attackers exfiltrated 42 gigabytes of data from a primary domain controller, a file server, and an SQL server. They subsequently deployed ransomware that encrypted an additional 182.7 gigabytes of data held on those same systems.
Regulatory Findings and Security Failings
The ICO determined that both organizations infringed upon UK General Data Protection Regulation requirements through multiple security oversights. David Doodson, head of investigations at the ICO, stated that ‘Password1’ is an inappropriate credential that acts as a wide-open door to malicious actors. He emphasized that a single weak password on an unnecessary account can enable serious attacks affecting thousands of individuals.
Specific violations included the failure to apply appropriate password-strength and complexity requirements to the compromised account. The organizations also failed to conduct regular audits of accounts created within Data Cymru’s network, allowing the operationally unnecessary test account to remain active for over a decade. Additionally, they did not review local administrator accounts after their initial deployment, leaving persistent vulnerabilities unaddressed.
Data Cymru faced additional criticism for lacking a contract with ONL that included legally mandated data protection terms required when appointing a sub-processor. The regulator noted that Data Cymru’s account reviews were neither scheduled nor routine, and they failed to cover the full contents of the Active Directory environment. These systemic failures allowed the compromised account to persist undetected for years.
Impact on Children and Families
The stolen data pertained to two specific projects designed to support children and families in Wales. The breach exposed the personal information of 3,300 people, the majority of whom were children. This incident highlights the risks associated with poor identity management practices in public sector data handling, particularly when sensitive demographic information is involved.
Ogi Networks Limited has served as Data Cymru’s third-party IT service provider since 2012. Data Cymru is funded by the Welsh government and is tasked with enabling local councils and other organizations to find, collect, analyze, and present data effectively. The reliance on a long-standing vendor relationship did not prevent the security lapses that led to this significant data breach.
What should you do?
Organizations should immediately audit all active and dormant accounts to remove unnecessary test or legacy credentials. Implement strict password complexity requirements and enforce regular reviews of local administrator privileges. Ensure that contracts with third-party IT providers include explicit data protection obligations and audit rights. Monitor for unauthorized data exfiltration and encryption activities that may indicate ransomware deployment.
What to do and how to stay safe: Data Cymru
- Conduct a comprehensive audit of all user accounts, specifically targeting dormant, test, or legacy accounts that are no longer operationally necessary.
- Enforce strict password complexity policies and ensure that no accounts, including service or test accounts, use weak or default credentials.
- Review and update contracts with third-party IT providers to ensure they include legally mandated data protection terms and clear security responsibilities.
- Implement routine, scheduled reviews of Active Directory and local administrator accounts to detect and remediate unauthorized or outdated privileges.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How did the attackers gain initial access to Data Cymru's network?
Attackers compromised a test account known as ‘Test 2’ that was protected only by the password ‘Password1’.
How much data was stolen and encrypted in the November 2024 incident?
Attackers exfiltrated 42GB of data and encrypted 182.7GB of data on file and SQL servers.
What specific GDPR violations did the ICO identify?
The ICO cited failures in password complexity, lack of regular account audits, and missing data protection terms in vendor contracts.
