The Information Commissioner’s Office has reprimanded broadband firm Ogi Networks and local government data unit Data Cymru over a 2024 ransomware attack. Neither has been fined.
The data of 3,300 people, most of them children, was stolen in a ransomware attack on two Welsh organisations that left a long-forgotten test account protected by the password “Password1”. The Information Commissioner’s Office (ICO) has reprimanded Ogi Networks Limited (ONL) and Data Cymru for breaching data protection law. The attack took place on 1 November 2024. The ICO says the password was classed as “very weak” by a third-party testing tool, which estimated it could be cracked in under a second.
How the attack happened
Criminals exploited a test account called “Test2”, which had existed for more than 12 years. It was created in January 2012 and was protected only by the weak password. The ICO said the account had either been active since it was created or was reactivated by accident before the attack.
The ransomware encrypted 182.7GB of data, and 42GB was taken from Data Cymru’s systems. The stolen information concerned two projects supporting children and families. The ICO has not said exactly what the files contained, such as addresses, dates of birth or health records. It has not named a criminal group, reported any arrests, or said the data has been used for fraud. The source gives the password once as “Passwrod1”, but the ICO identifies it as “Password1”.
Wider failings found
The Test2 account was not the only weakness. Administrator accounts on three affected systems had kept the same passwords since they were set up in January 2012, and Ogi Networks had not reviewed them. They had elevated system privileges. The ICO also found that Data Cymru had not put in place the data protection terms required when it appointed Ogi Networks as a sub-processor. The two organisations had not properly documented who was responsible for managing network accounts, checking access permissions, auditing the Active Directory environment, finding obsolete accounts or making sure outsourced IT met data protection requirements. The regulator said this unclear division of responsibility contributed to the prolonged failures.
According to the research notes, the ICO found separate breaches of UK GDPR. Ogi Networks infringed Article 32(1)(b) and (d), which cover maintaining appropriate security and testing it regularly. Data Cymru infringed Article 28(4), on its contract with a sub-processor, as well as Article 32(1)(b) and (d).
What has changed
After the investigation, Ogi Networks introduced a process that prompts customers to review active accounts regularly and recommends which should be removed. It also tightened access controls, including multi-factor authentication. Data Cymru brought in periodic account reviews and stronger access controls, also including multi-factor authentication. The ICO recorded that the two entered into a compliant data-processing contract on 30 April 2025, about six months after the attack. These measures do not reverse the exposure of the data already stolen.
In a statement reported by The Independent on 20 October, Ogi Networks acknowledged that the 2012 test account should have been removed long before the attack. It said it worked with Data Cymru to review every network account within a week and disabled unnecessary accounts the same day. It said it brought in independent cybersecurity specialists and later introduced multi-factor authentication for remote access. It said the incident was confined to the server it hosted for Data Cymru and that no other customer’s information was affected. That is the company’s account.
Reprimands, not fines
The ICO issued formal reprimands, not financial penalties. A reprimand is a formal finding that an organisation breached data protection law, and it is not a fine or a criminal conviction. The ICO’s enforcement register dates Ogi Networks’ reprimand to 14 October 2026, six days before it published its detailed findings on 20 October.
