Data Cymru ransomware through a 12-year-old test account with the password Password1

Data Cymru, the Welsh local government data unit, disclosed on November 11, 2024 that a ransomware attack had disrupted its systems. The ICO later found that the attacker got in on November 1, 2024 through 'Test2', a test account its IT provider Ogi Networks created in January 2012 with the password 'Password1', and that local administrator accounts on the three affected systems had kept the same password for more than 12 years, which The Register reports let the attacker reuse harvested hashes. The attacker took 42GB and encrypted 182.7GB, exposing personal information on 3,300 people, most of them children; both organizations introduced MFA and account reviews afterwards.

Victim

Data Cymru (Local Government Data Unit Wales), with its IT provider Ogi Networks

Industry

Government

Country

United Kingdom

Intrusion began

Nov 1, 2024

First disclosed

Nov 11, 2024

Actor

Financially motivated

Initial access

Stolen credentials

Identity control that failed

Identity lifecycle

MFA

Not disclosed

Abused identity

Human account

Records affected

3,300 (People whose personal information was taken, most of them children, per the ICO.)

Disclosed cost

Not disclosed