A cybersecurity incident involving an outdated account and inadequate password protection has exposed personal information belonging to approximately 3,300 individuals in Wales, the majority of whom were children. The breach has raised concerns about how organisations protect sensitive records and manage accounts that are no longer needed.
The UK Information Commissioner’s Office (ICO) published its findings on October 20, 2026, following an investigation into a ransomware attack that occurred in November 2024. The incident involved Ogi Networks Limited and Data Cymru, a Welsh local government data unit. Both organisations received reprimands after investigators identified shortcomings in their cybersecurity arrangements.
According to the investigation, attackers gained access through an old test account created in January 2012. The account, named “Test2,” was protected by the password “Password1,” which security assessments identified as extremely weak. Despite being unnecessary for ongoing operations, the account remained accessible for more than a decade, creating a potential entry point into the network.
After gaining access, the attackers reportedly encrypted approximately 182.7 gigabytes of data using ransomware and stole around 42 gigabytes. The compromised records were connected to two projects supporting children and families, making the incident particularly concerning because of the sensitive nature of the information involved.
The ICO’s investigation identified security failures at both organisations. Ogi Networks, which supplied IT services to Data Cymru, did not regularly review accounts it had created on the organisation’s network. Investigators also discovered administrator accounts across three affected systems that had continued using the same password for more than 12 years.
Data Cymru was criticised for failing to ensure that the obsolete test account had been removed or adequately secured. The regulator also found that the organisations lacked a legally compliant data-processing agreement when the attack occurred. This meant their respective responsibilities for protecting information had not been properly established through the required agreement.
The findings illustrate how neglected digital accounts can undermine wider security systems. While companies may invest in newer cybersecurity technologies, outdated credentials can remain a significant weakness if they are not regularly reviewed, disabled or replaced.
Following the breach, Ogi Networks strengthened its access controls and introduced more frequent account reviews. The company also encouraged customers to identify and close unnecessary accounts. Multi-factor authentication was introduced to provide an additional barrier against unauthorised access.
Data Cymru also revised its security procedures, introducing periodic account reviews and stronger access protections. The two organisations subsequently signed a data-processing agreement on April 30, 2025, clarifying their responsibilities for handling and safeguarding personal information.
The incident underscores the importance of protecting children’s information, which can contain identifying details that must be handled with particular care. Organisations responsible for such records need to maintain strong access controls, use unique passwords, enable multi-factor authentication and regularly assess their systems for vulnerabilities.
The case also demonstrates why businesses must establish clear security responsibilities when working with external IT providers. Regular communication, effective monitoring and legally compliant agreements can help ensure that security weaknesses are identified before attackers exploit them.
Data Cymru later merged with the Welsh Local Government Association. Representatives stated that there was no evidence that the stolen information had been further distributed or misused. However, the exposure of personal records remains a serious concern because compromised information may potentially be used for identity-related fraud or other harmful purposes.
The ICO’s findings serve as a reminder that major cybersecurity incidents can result from basic security oversights rather than highly sophisticated attacks. An unused account protected by a weak password was enough to create a significant vulnerability.
As organizations continue to manage growing volumes of personal information, the incident reinforces the need for regular security reviews, responsible data management and stronger protections for vulnerable individuals. Ensuring that obsolete accounts are closed and access credentials remain secure is essential to reducing the risk of future breaches.
You can watch the video below