A 12-Year-Old Test Account and 'Password1' Led to a Ransomware Attack on Children's Data

The UK's Information Commissioner's Office (ICO) has reprimanded Data Cymru, a Welsh government-funded data unit, and its third-party IT provider, Ogi Networks Limited, over a November 2024 ransomware attack. Attackers got in through a test account called 'Test 2', which had existed for more than 12 years and was protected only by the password 'Password1'.

From there, the attackers moved into the network and encrypted 182.7GB of data on file servers and an internal database server. Before deploying the ransomware, they also copied 42GB of data from a domain controller, a file server and a database server. The stolen information related to two projects supporting children and families in Wales and included the personal data of 3,300 people, most of them children.

The ICO found both organisations had infringed UK GDPR. Data Cymru had no contract with its IT provider containing the legally required data protection terms for a sub-processor. Its account reviews were not scheduled or routine, and did not cover the full contents of Active Directory. The ICO said the failings continued without being identified or addressed. David Doodson, the ICO's head of investigations, said a single weak password on an account that was no longer needed can leave the door open to a serious attack affecting thousands of people.