ICO reprimands Ogi and Data Cymru after a 12-year-old test account with Password1 let ransomware in

The UK Information Commissioner's Office issued reprimands on October 20 to Ogi Networks Limited (ONL), an IT provider, and the Local Government Data Unit Wales (Data Cymru) over a ransomware attack on November 1, 2024. The attacker got in through a test account called "Test2" that had existed for more than 12 years, protected by the password "Password1". It took 42 GB of data and encrypted 182.7 GB, exposing personal information on 3,300 people, mostly children, from two projects supporting children and families. The Register, citing the reprimand, reported that three systems shared one local administrator password, which let the attacker reuse harvested hashes. The ICO found ONL breached UK GDPR Article 32 through weak password controls, no account audits and no regular security testing, and that Data Cymru also lacked a compliant processing contract. "Password1 is not an appropriate password," said David Doodson, the ICO's head of investigations.

Why it matters

A test account nobody owns is an orphaned account: it never goes through a leaver process, so it outlives the project, the people and the password policy. Shared local admin passwords then turned one weak login into the whole estate.

The ICO's expectations double as a checklist. Disable test, dormant and former-user accounts when their purpose ends, and review all accounts and groups, not a sample. Block common passwords at the directory, require MFA for remote access, and give every system a unique local admin password (Windows LAPS does this). If a provider runs your directory, write account reviews and security duties into the contract. Weak defaults were also behind Denmark's CPR breach this month.

Source: ICO