Welsh data breach exposed 3,300 records after company used 'Password1' for decade-old test account

ICO reprimands Ogi Networks and Data Cymru over security failures that exposed children's data

By LineZotpaper

Published21 October 2026

Read Time2 min

Sources2 outlets

Hackers gained access to personal information belonging to 3,300 people, mostly children, after breaching an account protected by the password ``Password1.'' The Information Commissioner's Office (ICO) has reprimanded Ogi Networks Limited (ONL) and Data Cymru for the attack, which occurred on 1 November 2024.

The ICO found that ONL created a test account, known as Test2, in 2012 and protected it with the password ``Password1.'' The account was never audited or removed, remaining active for more than 12 years. During a ransomware attack, hackers encrypted 182.7GB of data and stole 42GB from Data Cymru's systems, exposing information related to two projects supporting children and families.

David Doodson, head of investigations at the ICO, said: ``Password1 is not an appropriate password, it is a wide-open door to nefarious actors. This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands.''

Doodson added that responsibility for the failures did not sit with one organisation alone. The watchdog said Data Cymru failed to put a data protection agreement in place with ONL, and there was a gap in responsibility between the two organisations. Data Cymru also failed to ensure the dormant test account was identified and removed or updated to meet stronger password requirements.

A spokesperson for ONL said: ``Within a week of the attack, we'd worked with Data Cymru to check every account on its network and switched off the ones it no longer needed that same day. We also brought in independent cyber-security specialists to investigate.'' The spokesperson added that since then the company has protected remote access with multi-factor authentication and introduced regular account reviews for customers whose networks it looks after.

Both organisations have since introduced stronger security measures. Data Cymru, which merged with the Welsh Local Government Association (WLGA) in 2025, now follows WLGA data protection protocols including strengthened passwords. A WLGA spokesperson said it remains committed to maintaining robust information governance standards and noted that dormant user accounts have been removed, password and remote access controls strengthened, and contractual responsibilities for security clearly defined.

Analysis

Why This Matters

The breach exposed data of thousands of children, raising serious concerns about the protection of vulnerable individuals' information.
The use of a trivial password on a long-forgotten account highlights fundamental security failures that can lead to large-scale data theft.
The ICO's reprimand and the mandatory security improvements set a benchmark for other organisations outsourcing IT services.

Background

The Information Commissioner's Office is the UK's independent regulator for data protection, enforcing the UK General Data Protection Regulation (GDPR). Companies that process personal data must implement appropriate technical and organisational measures to protect it. The attack on Data Cymru's systems exploited poor password hygiene and a lack of regular account auditing, both longstanding weaknesses in many organisations.

Key Perspectives

Ogi Networks Limited (ONL): Accepted the ICO's findings, stated that the account should have been removed long before the attack, and said it had acted swiftly to strengthen security and introduce regular account reviews for customers. Data Cymru / Welsh Local Government Association (WLGA): Expressed commitment to robust information governance, noted that no evidence suggests stolen data was shared or misused, and implemented strengthened password and access controls. Information Commissioner's Office: Stressed that the incident is a lesson for every organisation to use strong passwords, enable multi-factor authentication, regularly review user accounts, and clearly define cybersecurity responsibilities when services are outsourced. Critics/Skeptics: While all parties have cooperated, the long period of inaction before the attack raises questions about how many similar dormant accounts exist in other organisations and whether such basic errors will recur without stricter regulatory penalties.

What to Watch

Whether the ICO imposes further enforcement action if similar weaknesses are found in ONL's other customer networks.
How Data Cymru's transition to WLGA governance affects long-term data protection practices.
The potential for affected individuals to seek compensation, given the sensitivity of the exposed data involving children.

Sources

Checked

10 claims in this story checked against 1 source: 9 supported.

Show each claim

Partly supportedThe breach exposed 3,300 records.BBC News: “The hackers exposed personal information belonging to 3,300 people, mostly children”
SupportedThe ICO reprimanded Ogi Networks Limited and Data Cymru over the attack on 1 November 2024.BBC News: “The Information Commission's Office (ICO) has reprimanded Ogi Networks Limited (ONL) and Data Cymru after the attack on 1 November 2024.”
SupportedThe breach exposed personal information belonging to 3,300 people, mostly children.BBC News: “The hackers exposed personal information belonging to 3,300 people, mostly children”
SupportedThe attackers encrypted 182.7GB of data and stole 42GB from Data Cymru’s systems.BBC News: “During the ransomware attack, the hackers encrypted 182.7GB of data and stole 42GB from Data Cymru's systems.”
SupportedThe test account, Test2, was created in 2012 and protected by “Password1.”BBC News: “According to the watchdog, ONL created a test account in 2012 and used the password "Password1" to protect it”
SupportedThe account was not audited or removed for more than 12 years.BBC News: “failing to audit it or remove it for more than 12 years.”
SupportedDavid Doodson said, “Password1 is not an appropriate password, it is a wide-open door to nefarious actors.”BBC News: “David Doodson, head of investigations at the Information Commission's Office, said: "Password1 is not an appropriate password, it is a wide-open door to nefarious actors."”
SupportedDoodson said responsibility for the failures did not sit with one organisation alone.BBC News: “Doodson added the responsibility for "these failures did not sit with one organisation alone".”
SupportedONL’s spokesperson said the company checked every account on Data Cymru’s network and switched off unneeded accounts within a week of the attack.BBC News: “Within a week of the attack, we'd worked with Data Cymru to check every account on its network and switched off the ones it no longer needed that same day.”
SupportedData Cymru merged with the Welsh Local Government Association in 2025 and now follows its data protection protocols, including strengthened passwords.BBC News: “Data Cymru merged with the Welsh Local Government Association (WLGA) in 2025 and now follows WLGA data protection protocols, including the use of "strengthened" passwords.”