The Data Cymru ransomware attack began with a test account created more than 12 years earlier and protected by the password Password1. The incident led to the theft of personal information relating to 3,300 people, most of them children.
On 20 October 2026, the Information Commissioner’s Office announced reprimands against Ogi Networks Limited and the Local Government Data Unit Wales, also known as Data Cymru. The regulator found that weaknesses in account management, password controls and security oversight helped an intruder enter the network, move between systems, steal data and deploy ransomware.
How the Data Cymru ransomware attack unfolded
Data Cymru suffered the ransomware attack on 1 November 2024. The organisation helps public bodies across Wales use data, while Ogi Networks supplied server and connectivity infrastructure, licensing and support.
The attacker gained access through an Active Directory test account named Test2. Ogi Networks had created this account on 13 January 2012 during its initial onboarding work for Data Cymru, apparently to test access before real users were migrated to the service.
Test2 was given the password Password1. According to the ICO, a password strength tool rated this as very weak and estimated that it could be cracked in less than a second. The account was available to the attacker more than 12 years after its creation, although it may have been inadvertently reactivated.
Public findings indicate that the account was either left active or inadvertently reactivated before the attack. There was no effective auditing process to identify unnecessary accounts in Data Cymru’s Active Directory and ensure they were disabled or removed.
Data theft took place before encryption
After establishing access, the intruder exfiltrated 42 GB of information from three parts of the environment: the primary domain controller, a file server and an internal Microsoft SQL Server system. The attacker then deployed ransomware that encrypted 182.7 GB on the file server and SQL server.
The stolen personal information related to 3,300 people and came from two projects supporting children and families. Most of the affected individuals were children, increasing the sensitivity of the incident and the potential consequences of unauthorised disclosure.
No ransomware group or individual threat actor had been publicly identified when the ICO announced its action. No IP addresses, malicious file hashes, domains or other technical indicators of compromise were published, so organisations cannot use a specific IOC set to search for the same attacker.
Shared administrator passwords enabled lateral movement
The weak Test2 credential provided the initial route into the network, but it was not the only control failure behind the Data Cymru ransomware incident. The ICO found that local administrator accounts on three affected systems all used the same password.
Once one system had been breached, the attacker could collect local account hashes and use them to authenticate to other systems. This password reuse therefore made it easier to move laterally from the initial point of compromise towards servers containing valuable data.
Ogi Networks confirmed that it had not reviewed the local administrator accounts after their initial deployment. The accounts remained active and continued using the same default passwords established during the initial project in January 2012, a period of more than 12 and a half years.
The affected technology included a Microsoft Active Directory domain controller, a Windows file server and a Microsoft SQL Server instance. The ICO did not disclose product versions, and the intrusion was not attributed to a vulnerability in those products. It involved the misuse of valid credentials and insecure account configurations.
Confirmed exploitation, not a theoretical weakness
This was confirmed exploitation in a live environment rather than a proof of concept or a warning about a newly discovered software flaw. The attacker successfully used the Test2 account, accessed multiple systems, removed 42 GB of data and encrypted a further 182.7 GB.
The sequence also shows that ransomware was the final stage of a broader compromise. Data theft occurred before encryption, meaning recovery from backups alone could not address the exposure of personal information.
Timeline of the Data Cymru ransomware case
- 13 January 2012: Ogi Networks created the Test2 account during its initial work for Data Cymru and assigned it the password Password1.
- 1 November 2024: An attacker used the account to access the network, exfiltrated 42 GB of data and encrypted 182.7 GB across a file server and SQL server.
- 27 to 28 March 2025: Early reporting tentatively connected an exposure involving children in Cardiff with a Data Cymru breach, but did not provide the technical findings later published by the ICO.
- 14 October 2026: The ICO issued formal reprimand documents to Ogi Networks and Data Cymru.
- 20 October 2026: The ICO publicly announced both reprimands and disclosed the confirmed technical details of the incident.
Why the ICO reprimanded both organisations
The ICO reprimanded Ogi Networks and Data Cymru under Article 32 of the UK GDPR. This provision requires controllers and processors to implement appropriate technical and organisational measures to protect personal information and to assess those measures regularly.
For Ogi Networks, the regulator identified failures including the long-lived test account, weak password selection, shared local administrator credentials and the absence of regular account reviews. Its findings also highlighted a lack of auditing procedures for reviewing users within Data Cymru’s Active Directory.
Data Cymru retained overall control of its network, including the ability to instruct Ogi Networks to create or remove accounts. The ICO concluded that responsibility did not rest with one organisation alone because neither party had established sufficiently clear and effective arrangements for identifying and removing obsolete accounts.
The regulator issued reprimands rather than financial penalties. These formal enforcement actions record the failures identified and reinforce the requirement for both organisations to improve how access, security responsibilities and ongoing reviews are managed.
What organisations should do after this incident
The Data Cymru ransomware findings are particularly relevant to organisations with ageing Active Directory environments or outsourced IT operations. A supplier relationship does not remove the need to define who approves accounts, who reviews them and who is responsible for disabling them.
Organisations should prioritise actions directly connected to the failures in this case:
- Identify test, dormant, temporary and service accounts, then disable those without a documented operational need.
- Replace shared local administrator passwords with unique credentials for every managed system.
- Apply multi-factor authentication to remote access and other routes that could expose network credentials.
- Review Active Directory accounts and privileges on a documented schedule, including accounts managed by external providers.
- Set clear contractual responsibilities for account creation, approval, monitoring and removal.
The central lesson is not simply that Password1 was weak. The greater failure was allowing an old test account and reused administrator credentials to persist for years without effective review, creating a route from one forgotten login to large-scale data theft and ransomware.
Originally reported by theregister.com.
