UK Privacy Regulator Reprimands Two Welsh Organizations After Ransomware Attack Exposes Children's Data

Key Takeaways

• Thousands Affected by Ransomware Attack: The personal information of 3,300 people, most of them children, was stolen during a November 2024 attack on Data Cymru's systems.
• Weak Password Remained in Use for 12 Years: Attackers exploited a test account created in January 2012 that was protected by the password "Password1," which had never been changed.
• Security Failures at Both Organizations: The Information Commissioner's Office reprimanded Ogi Networks Limited and Data Cymru for failures involving account management, security reviews and oversight of outsourced IT services.
• Contractual and Oversight Deficiencies: Data Cymru lacked the legally required contractual provisions governing ONL's appointment as a sub-processor and had not clearly documented responsibilities for monitoring its Active Directory services.
• Security Measures Strengthened: Both organizations introduced periodic account reviews or related procedures and strengthened access controls, including multi-factor authentication, following the attack.

Deep Dive

The UK's Information Commissioner's Office (ICO) reprimanded Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, on October 20 after finding that both organizations had failed to maintain adequate security controls and oversight of accounts on Data Cymru's network.

The attack took place on November 1, 2024, encrypting 182.7 gigabytes of data. Attackers also took 42 gigabytes from Data Cymru's systems, including personal information associated with two projects supporting children and families.

Investigators traced the intrusion to an account named "Test2," which ONL had created in January 2012. The account was no longer needed for operational purposes but had never been removed. The ICO could not establish whether it had remained continuously active or had been inadvertently reactivated before the attack.

Its password, however, had remained unchanged since the account was created. When assessed using a third-party password-strength tool, "Password1" was classified as very weak, with an estimated compromise time of less than one second.

"Password1 is not an appropriate password, it is a wide-open door to nefarious actors," said David Doodson, the ICO's head of investigations.

The investigation found that neither organization had established sufficiently effective procedures to identify and remove accounts that were no longer required. ONL had created the test account, while Data Cymru retained overall control of its network, including the authority to instruct ONL to create or delete accounts.

The ICO found that ONL had infringed Articles 32(1)(b) and 32(1)(d) of the UK General Data Protection Regulation by failing to implement appropriate measures to maintain the confidentiality and integrity of its processing systems and regularly test and evaluate the effectiveness of those measures.

ONL had not applied adequate password-strength or complexity requirements when creating the Test2 account. It also failed to conduct regular audits of accounts it had created within Data Cymru's network, allowing the unnecessary account to remain in existence for more than 12 years, including over six years after ONL's obligations under the GDPR came into effect.

The regulator identified further weaknesses involving local administrator accounts. On three affected systems, administrator passwords had remained unchanged for more than 12 years, with no reviews conducted after the accounts were initially deployed.

Data Cymru was found to have infringed Articles 28(4), 32(1)(b) and 32(1)(d) of the UK GDPR. Its failures included inadequate account reviews and deficiencies in the contractual arrangements governing ONL's services.

The organization had not put in place a contract containing the legally mandated data protection terms required for ONL's appointment as a sub-processor. It had also failed to document clearly how ONL's Active Directory services would be delivered, monitored and audited, leaving responsibilities between the organizations insufficiently defined.

Data Cymru's account reviews were neither scheduled nor routine and did not cover the full contents of Active Directory. Consequently, the Test2 account was not identified and removed or updated to comply with stronger password requirements that Data Cymru subsequently introduced. The ICO found that the infringements at both organizations continued without being identified or addressed.

"The responsibility for these failures did not sit with one organisation alone," Doodson said.

The findings show how weaknesses in account administration and oversight can persist when responsibilities between an organization and its IT provider are not adequately defined or enforced. Although Data Cymru retained authority over its network, it had not established sufficiently comprehensive reviews to identify accounts that no longer served a legitimate purpose. ONL, meanwhile, had failed to review accounts it created and maintain appropriate password controls.

Both organizations introduced security improvements following the incident. ONL established a process prompting customers to review active accounts periodically and providing recommendations about accounts that should be removed. It also strengthened access controls, including through the use of multi-factor authentication. Data Cymru introduced periodic account reviews and strengthened its own access controls, including the implementation of multi-factor authentication.

On April 30, 2025, the organizations entered into a data processing contract that the ICO described as legally compliant. In its announcement, the regulator emphasized the importance of routinely identifying and removing dormant accounts, preventing the use of weak passwords and protecting remote access with multi-factor authentication. It also called for comprehensive reviews of account permissions and security groups, unique credentials for privileged accounts and clearly documented security responsibilities in agreements with external IT providers.

The ICO issued reprimands to both organizations. Its announcement did not report financial penalties. The regulator did not establish in its announcement whether the stolen information had subsequently been misused.

Doodson said the incident demonstrated the consequences of failing to maintain fundamental security controls, particularly when responsibility for those controls is divided between organizations.

"Basic cyber security controls are not optional, and the negative consequences of not having them can be severe," he said.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey