A Forgotten Test Account and 'Password1' Opened the Door to a Ransomware Attack on Welsh Data Body

The UK Information Commissioner's Office (ICO) has reprimanded Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, after a ransomware attack exposed personal data relating to 3,300 people, mostly children. The regulator issued reprimands rather than fines. ONL provided server and connectivity infrastructure, licensing and support to Data Cymru.

On 1 November 2024, an attacker used a test account called "Test2" to get into the Data Cymru network and encrypt 182.7 GB of data on a file server and an internal database server. Before deploying the ransomware, the attacker also stole 42 GB of data from a domain controller, a file server and an SQL server. ONL said it created the account on 13 January 2012 to test user access before migrating real users, and gave it the password "Password1". The ICO cited a password strength tool that rated it "very weak", with an estimated cracking time of less than a second.

The problems went further. The local administrator accounts on the three affected systems all shared the same password, so once one system was breached, the attacker could reuse account hashes to access others. ONL confirmed it did not review local administrator accounts after their initial deployment, meaning they kept the same default passwords for more than 12.5 years.