October 20, 2026 - 282 views
Organisations across Wales are being reminded of the need to protect sensitive personal information, after a major cyber security failure exposed the details of 3,300 people, most of them children.
The Information Commissioner's Office says weak passwords and poor management of unused accounts are unacceptable risks that can have serious consequences.
Two Wales-based organisations have been reprimanded by the Information Commissioner's Office after a ransomware attack exposed the personal information of 3,300 people, most of them children.
The attack, on 1 November 2024, exploited a test account protected by the password ‘Password1’, which had been in place for more than 12 years.
The Information Commissioner's Office (ICO) found that the account, known as ‘Test2’, had either remained active since it was created in January 2012 or had been inadvertently reactivated before the attack.
A review using a third-party password strength tool classified the password as very weak, with the potential to be compromised in less than a second.
The attack encrypted 182.7 gigabytes of data, with 42 gigabytes taken from the systems of the Local Government Data Unit – Wales, known as Data Cymru. The compromised information related to two projects supporting children and families.
The ICO issued reprimands to Ogi Networks Limited, which created the test account, and Data Cymru, which retained overall control of its network.
David Doodson, the ICO's Head of Investigations, said the incident demonstrated how a weak password on an account no longer needed could leave the door open to a serious cyber attack affecting thousands of people.
He said responsibility for the failures did not rest with one organisation alone, with neither having sufficiently clear and effective measures to identify and remove old accounts.
The investigation also found that Ogi Networks had failed to carry out regular audits of accounts it had created on Data Cymru's network. Local administrator accounts on three affected systems had also retained the same password for more than 12 years.
Data Cymru was found to have failed to put a legally compliant data processing contract in place with Ogi Networks, or clearly document how its outsourced network services would be delivered, monitored and audited.
Its account reviews were neither routine nor comprehensive, meaning the dormant test account was not identified and removed. The ICO found that the security failings at both organisations had continued without being addressed.
Since the incident, Ogi Networks has introduced a process encouraging customers to review active accounts periodically and strengthened access controls, including multi-factor authentication.
Data Cymru and Ogi Networks entered into a legally compliant data processing contract in April 2025. Data Cymru has also introduced periodic account reviews and strengthened its access controls.
The ICO said the case underlined the importance of removing unused accounts, enforcing strong passwords, protecting remote access with multi-factor authentication and ensuring clear responsibilities when organisations outsource IT services.
Mr Doodson said basic cyber security controls were not optional and warned that failing to put them in place could have serious consequences not just for the organisations themselves, but for people whose information features in a company's archives.
Conwy Mind is one of the North Wales organisations who have recently reported issues with stored online data.
