ICO Reprimands Welsh Bodies After “Password1” Test Account Led to Ransomware Breach

The ICO issued reprimands to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, following the ransomware attack. The personal information of 3,300 people was taken, most of them children. It issued reprimands, not fines. The enforcement notices don't explain that choice in the material available, so any theory about why is speculation.

What happened​

The attack took place on 1 November 2024. It encrypted 182.7GB of data, and 42GB was taken from Data Cymru's systems. The compromised information related to two projects supporting children and families.

The regulator says the Test2 account had existed for more than 12 years. It had either stayed active since creation or been inadvertently reactivated before the incident. ONL told the ICO it created the account in January 2012, during its first project for Data Cymru. According to The Register's reading of the reprimand documents, the likely purpose was to test user account access before migrating real users.

A third-party password-strength tool classified "Password1" as "very weak". It estimated the password could be compromised in less than a second. The Register says the tool was Bitwarden's.

The Register's account of the reprimand documents adds technical detail that the ICO's press summary leaves out:

• The attacker is said to have exfiltrated data from a primary domain controller, a file server and an SQL server before deploying ransomware.
• Local administrator accounts on the three affected systems shared one password. Once one system was breached, the local account hashes could be collected and reused to authenticate to the others.
• ONL did not review local administrator accounts after deploying them, so they kept their original 2012 default passwords for more than 12.5 years.

I'd treat those points as reported from the reprimand PDFs, not as findings in the ICO's announcement. They are the most instructive part of the case for Windows admins.

Why the ICO blamed both sides​

The ICO did not treat this as a supplier-only failure. Its head of investigations, David Doodson, said responsibility did not sit with one organisation alone. ONL created the test account, while Data Cymru retained overall control of its network, including the ability to instruct ONL to create or remove accounts.

ONL was found to have infringed Articles 32(1)(b) and 32(1)(d) of the UK GDPR. The ICO said ONL:

• created Test2 with "Password1" and applied no appropriate password-strength or complexity requirements;
• did not regularly audit accounts it had created in Data Cymru's network. That let an operationally unnecessary account persist for over 12 years, including more than six years after its GDPR obligations began;
• did not review local administrator accounts after initial deployment, so accounts on three affected systems kept the same password for more than 12 years.

Data Cymru was found to have infringed Articles 28(4), 32(1)(b) and 32(1)(d). The ICO said Data Cymru:

• had no contract with ONL containing the legally mandated data-protection terms for appointing a sub-processor;
• had not clearly documented how ONL's Active Directory services would be delivered, monitored or audited, leaving a gap in who was responsible for what;
• failed to ensure the dormant Test2 account was removed or updated to meet the stronger password requirements it introduced later;
• ran account reviews that were not scheduled or routine and did not cover all of Active Directory.

What changed afterwards​

ONL introduced a process prompting customers to review active accounts periodically, with recommendations on accounts to remove. It also strengthened its account access controls, including multi-factor authentication. On 30 April 2025, Data Cymru and ONL entered into a legally compliant data processing contract. Data Cymru also introduced periodic account reviews and strengthened access controls, including MFA.

A practical checklist for admins​

The ICO's lessons for organisations map neatly onto a standard identity hygiene routine:

1. Remove accounts that are no longer needed. Test, dormant and former-user accounts should be routinely identified and deactivated.
2. Block weak and commonly used passwords. Password controls should stop credentials like "Password1" from being set at all.
3. Protect remote access with MFA by default.
4. Audit the whole account environment. Reviews should cover accounts, permissions and security groups, not a subset.
5. Avoid shared administrative credentials. Privileged accounts need unique credentials so one compromised system doesn't open others.
6. Define responsibilities in contracts. Agreements with IT providers and sub-processors should say how controls are delivered, monitored and audited, and include all legally required terms.

In a Windows estate, the shared local administrator password is the item most likely to still be lurking. Per-machine unique local admin passwords are the standard answer, and Microsoft's Windows LAPS is the usual tool for that. Neither the ICO nor The Register mentions LAPS, so that is general industry knowledge, not a finding from this case.

Caveats​

• The ICO recommends MFA for remote access, but the available material doesn't establish whether Test2 was reachable remotely. It doesn't show whether MFA would have stopped this particular attack, so don't read the case as proof that it would.
• The ICO's enforcement listing for ONL shows a date of 14 October 2026. The public announcement came on 20 October 2026.
• The regulator is now styled the Information Commission's Office. The ICO's notes to editors say new legislation took effect on 30 September 2026 and abolished the office of the Information Commissioner, transferring its powers to the new Information Commission.

The takeaway​

Nothing in this case is exotic. There was no zero-day and no clever malware, just an account created for a migration test and never cleaned up, plus local admin credentials nobody reviewed for over a decade. The ICO's message to outsourced IT arrangements is that the customer and the provider each need to know who audits what. Otherwise the audit may not happen at all.