ICO reprimands ONL and Data Cymru over weak password that left children's data exposed

'Password1' test account active for 12 years led to breach of 3,300 records

By LineZotpaper

Published20 October 2026

Updated20 October 2026

Read Time2 min

Sources2 outlets

The UK's Information Commissioner's Office (ICO) has reprimanded broadband provider Ogi Networks Limited (ONL) and the Welsh local government data unit Data Cymru for breaching GDPR rules. An investigation found that a dormant test account protected only by the password 'Password1' allowed cyber criminals to access the personal data of 3,300 people, the majority of whom were children.

The ICO's investigation revealed that hackers exploited an account named 'Test 2', set up by ONL on Data Cymru's network in January 2012. The account, which had been operational for over 12 years, was secured solely by the password 'Password1', a code the watchdog described as 'very weak' and vulnerable to compromise in under one second.

David Doodson, head of investigations at the ICO, said the weak password had left the door wide open to a serious cyber attack. 'Password1 is not an appropriate password, it is a wide-open door to nefarious actors,' he stated. The regulator placed responsibility on both organisations: ONL for creating the account and failing to enforce password policies or conduct regular audits; and Data Cymru for retaining overall network control without removing the unnecessary account or having a legally compliant data processing contract in place.

The ransomware attack resulted in the theft of over 180 GB of data, including 42 GB from Data Cymru's systems. The compromised information pertained to two family support projects, meaning most of the 3,300 affected individuals were children.

Both organisations have since entered into a compliant data processing contract and strengthened their security procedures, including implementing multi-factor authentication and improved account review processes.

Analysis

Why This Matters

A basic security lapse, such as a weak password on a forgotten test account, can directly lead to a large-scale data breach involving highly sensitive information about children.
The case highlights the joint responsibility of service providers and their clients under GDPR to maintain rigorous cyber security standards, including auditing accounts and managing third-party access.
The ICO's decision to issue a reprimand signals that such fundamental failures will attract regulatory scrutiny, serving as a warning to other organisations to review their own dormant accounts and password policies.

Background

Ogi Networks is a broadband provider operating in South Wales, while Data Cymru is a Welsh local government body that manages data systems for public services. The 'Test 2' account was created in January 2012 and remained active for over 12 years without being audited or removed. The ICO is the UK's independent regulator for data protection, operating under the UK GDPR and the Data Protection Act 2018.

Key Perspectives

The ICO (Regulator): Views the breach as a clear and preventable failure of basic cyber security hygiene. The reprimand is intended to emphasise that organisations must use strong passwords, enable multi-factor authentication, regularly review user accounts, and clearly define cyber security responsibilities in outsourced arrangements. ONL and Data Cymru (Reprimanded Organisations): Have acknowledged the findings and cooperated with the investigation. They have since addressed the deficiencies by entering into a proper data processing contract and adopting stronger security measures, including multi-factor authentication and routine account auditing. Critics and Security Experts: Are likely to see this as a stark reminder that fundamental security flaws remain a major vulnerability. The use of 'Password1' and the presence of a 12-year-old test account represent the kind of basic oversight that can have severe consequences, particularly when children's data is involved.

What to Watch

Whether the ICO escalates enforcement to a monetary penalty or takes similar action against other organisations with comparable security gaps.
If affected families pursue legal action against ONL or Data Cymru for the exposure of their children's personal data.
The broader impact on public trust in local government data management and outsourced IT service providers in the UK.

Sources

'Password1' and a forgotten test account land Welsh outfits in hot water · www.theregister.com - Articles
Cyber attackers hacked thousands of children’s data due to this common password fail · The Independent UK

Checked

10 claims in this story checked against 1 source: 7 supported.

Show each claim

SupportedThe ICO reprimanded ONL and Data Cymru over a weak password that exposed children’s data.The Independent UK: “The Information Commissioner’s Office (ICO) reprimanded broadband company Ogi Networks Limited (ONL) and Wales ’ local government data unit, Data Cymru, for breaching GDPR rules after the personal information of 3,300 people was accessed by cyber criminals. Most of the data related to children”
Partly supportedThe password-protected test account had been active for 12 years and led to a breach of 3,300 records.The Independent UK: “Hackers gained access by exploiting a test account, set up by ONL on Data Cymru’s network in November 2024 and active for 12 years, known as “Test 2”, which was protected only with the passcode “Password1””
SupportedThe ICO reprimanded both organisations for breaching GDPR rules.The Independent UK: “The Information Commissioner’s Office (ICO) reprimanded broadband company Ogi Networks Limited (ONL) and Wales ’ local government data unit, Data Cymru, for breaching GDPR rules”
Partly supportedMost of the 3,300 affected individuals were children.The Independent UK: “Most of the data related to children, as the compromised information related to two projects supporting families.”
Reports differThe test account was set up in January 2012.The Independent UK: “The ICO found that ONL failed to apply appropriate password-strength and complexity requirements to the “Test 2” account set up on January 2012.”
SupportedThe account was protected only by “Password1,” which could be compromised in under one second.The Independent UK: “This code, when checked against a third-party password strength tool, was classified as “very weak” and could be compromised in less than a second, according to the watchdog.”
SupportedDavid Doodson said, “Password1 is not an appropriate password, it is a wide-open door to nefarious actors.”The Independent UK: ““ Password1 is not an appropriate password , it is a wide-open door to nefarious actors,” he said.”
SupportedThe ransomware attack took more than 180 GB of data, including 42 GB from Data Cymru’s systems.The Independent UK: “More than 180GB of data was taken through a ransomware attack, 42GB coming from Data Cymru’s systems, the watchdog reported.”
SupportedONL was responsible for creating the account and failing to apply password requirements and conduct regular account audits; Data Cymru retained network control and failed to ensure the account was removed or have a compliant data-processing contract.The Independent UK: “ONL created the test account whilst Data Cymru retained overall control of its network, including the ability to instruct ONL to create or remove accounts.”
SupportedBoth organisations entered into a compliant data-processing contract and strengthened security, including multi-factor authentication and account-review processes.The Independent UK: “Since the incident, ONL and Data Cymru entered into a legally compliant data processing contract. Both organisations have strengthened account reviewing processes with multi-factor authentication, the report said.”