Weak password enabled breachThe Information Commissioner’s Office (ICO) reprimanded Ogi Networks Limited (ONL) and Data Cymru after a ransomware attack on 1 November 2024 exposed personal information belonging to 3,300 people, mostly children. The ICO said hackers gained access by using a test account called Test2 that had existed for more than 12 years and was protected by the password “Password1”. The ICO found that the ransomware attack encrypted 182.7GB of data and stole 42GB from Data Cymru’s systems.
“ The Information Commissioner’s Office (ICO) has reprimanded Ogi Networks Limited (ONL) and Data Cymru after the attack on 1 November 2024. ”
BBCDavid Doodson, head of investigations at the ICO, said: “Password1 is not an appropriate password, it is a wide-open door to nefarious actors.” David Doodson added that “This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands.”ICO cites shared responsibilityThe ICO said ONL created the test account in 2012 and used the password “Password1” to protect it, failing to audit it or remove it for more than 12 years. The ICO said ONL also did not review local administrator accounts after they were first deployed, with accounts on three affected systems using the same password for the same period of time. The ICO said Data Cymru failed to put a data protection agreement in place with ONL, creating a gap in responsibility between the two organisations.The ICO said Data Cymru failed to ensure the dormant test account was identified and removed, or updated to meet stronger password requirements. The ICO urged organisations to “use strong passwords, protect remote access with multi-factor authentication, regularly review every user account, and be completely clear about who is responsible for cyber-security when services are outsourced.”Aftermath and required fixesONL said it accepted the ICO’s findings and had “acted on them,” and it said it brought in independent cyber-security specialists after the attack. ONL told the ICO it worked with Data Cymru within a week of the attack to check every account on its network and switched off the ones it no longer needed that same day. ONL said it protected remote access with multi-factor authentication and introduced regular account reviews for the customers whose networks it looks after.
“ On 30 April 2025, Data Cymru and ONL entered into a legally compliant data processing contract. ”
BBCA WLGA spokesperson said it remained “committed to maintaining robust information governance standards and continually reviewing the measures we have in place” after the incident. The ICO said that on 30 April 2025, Data Cymru and ONL entered into a legally compliant data processing contract, and it said both organisations introduced stronger security measures following the breach.What some reports left outData Cymru merged with WLGA in 2025 and follows WLGA protocolsNot found in 7 outletsView outletsHide outletsHerald.WalesInfosecurity MagazineAOL.co.ukThe Independentnews.lavx.huNorth Wales LiveWales Online
——————————————————–
Click Here For The Original Source.
