Breaches and incidents
Ogi Networks and Data Cymru (Wales): ICO reprimands after ransomware entered via ‘Password1’ test account
The ICO reprimanded IT provider Ogi Networks Limited and Data Cymru (Local Government Data Unit, Wales) over a ransomware attack on 1 Nov 2024 that...
- Disclosed
- Verification
- Confirmed by two or more outlets
What happened
- The ICO reprimanded IT provider Ogi Networks Limited and Data Cymru (Local Government Data Unit, Wales) over a ransomware attack on 1 Nov 2024 that encrypted 182.7GB and took 42GB, exposing about 3,300 people, mostly children, linked to two projects supporting children and families (per Nation.Cymru and Infosecurity Magazine); the root cause was first made public with the reprimand.
- Root cause per the ICO as reported: the attacker used a test account named “Test2” (Infosecurity: “Test 2”) protected by “Password1”; Ogi did not enforce password strength or audit accounts it created, and Data Cymru’s account reviews were ad hoc and it lacked a compliant processor contract.
- No attacker named.
- Reprimands only, no fines; Ogi strengthened account access controls and the two signed a compliant data processing contract; the ICO’s David Doodson said “Password1 is not an appropriate password, it is a wide-open door to nefarious actors.”