The personal details of thousands of children and their families were breached in Wales after ransomware attackers compromised an account protected by a ‘Password1’ password, an investigation by the UK’s Information Commissioner’s Office (ICO) has revealed.

The data protection regulator issued a reprimand to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, for security failings relating to the November 2024 incident.

Data Cymru is funded by the Welsh government and is tasked with enabling local councils and other organizations to find, collect, analyze and present data effectively.

ONL has acted as Data Cymru's third-party IT service provider since 2012.

How the Attack Unfolded

Attackers gained initial access to Data Cymru’s network via a compromised test account known as ‘Test 2’, which had existed for more than 12 years. It was solely protected by the password ‘Password1’.

Access to this account enabled the threat actor to infiltrate Data Cymru’s network and encrypt 182.7GB of data held on a file servers and an internal database (SQL) server.

Before deploying the ransomware, the attackers exfiltrated 42GB of data from a primary domain controller, a file server and an SQL server. This compromised information related to two projects supporting children and families in Wales, which included the personal data of 3300 people, the majority of whom were children.

David Doodson, head of investigations at the ICO, criticized both organizations, stating: “Password1 is not an appropriate password, it is a wide-open door to nefarious actors. This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands.”

No Fine Issued Over Incident

Both ONL and Data Cymru were found to have infringed the UK GDPR legislation in various ways.

ONL’s failings included:

• Not applying appropriate password-strength and complexity requirements to an account
• Not conducting regular audits of accounts it had created within Data Cymru’s network, allowing the operationally unnecessary test account to remain in existence for more than 12 years
• Not reviewing local administrator accounts after their initial deployment

Data Cymru was criticized for failings such as not having a contract in place with ONL containing the legally mandated data protection terms required when appointing a sub-processor and for conducting account reviews that were not scheduled or routine and did not cover the full contents of Active Directory.

In its reprimand, published on October 20, the ICO said the infringements by both organizations continued without being identified or addressed.

However, neither organization has received a financial penalty for the infringements. The ICO highlighted remedial action taken following the incident, which included ONL strengthening its account access controls and Data Cymru and ONL entering into a legally compliant data processing contract.

Doodson said, “The lesson for every organization is straightforward: use strong passwords, protect remote access with multi-factor authentication, regularly review every user account, and be completely clear about who is responsible for cyber security when services are outsourced. Basic cybersecurity controls are not optional, and the negative consequences of not having them can be severe.”