ICO Reprimands Ogi and Data Cymru Over 'Password1'

The UK’s data protection regulator has reprimanded two Welsh organisations after a forgotten test account protected by the password “Password1” let in a ransomware attack that exposed children’s information. The Information Commissioner’s Office (ICO) announced the reprimands against Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, “known as Data Cymru”, on 20 October 2026.

These are reprimands, not fines. But the findings are blunt. “During the attack the personal information of 3,300 people was taken, the majority of whom were children,” the ICO said. The attack happened on 1 November 2024.

In brief

The ICO has reprimanded, not fined, Ogi Networks and Data Cymru over a November 2024 ransomware attack that took data on 3,300 people, mostly children.
The attackers got in through a test account that had used “Password1” for more than 12 years, a basic failure the ICO blames on both organisations.
The ICO has not named the attackers or said how the account was found.

What went wrong?

The attack exploited an account called “Test2” that “had existed for more than 12 years”, according to the ICO. It had “either remained active since it was created or been inadvertently reactivated before the incident”.

Throughout that time it was protected by “Password1”. When the ICO checked that against a third-party password strength tool, it was rated “very weak” and “could be compromised in less than a second”. The Register, quoting the ONL reprimand, says the tool was Bitwarden’s.

The attack “encrypted 182.7GB of data, with 42GB of data being taken from Data Cymru’s systems”, the ICO said. The stolen information “related to two projects supporting children and families”.

The Register reports that ONL, which it describes as an altnet, provided server and connectivity infrastructure, licensing and support to Data Cymru, which helps public bodies across Wales use data.

Date	Event
Jan 2012	ONL creates “Test2” with “Password1”
1 Nov 2024	Ransomware attack
30 Apr 2025	Compliant data processing contract signed
14 Oct 2026	Reprimand documents dated
20 Oct 2026	ICO announces reprimands

Source: ICO release and reprimand documents, 20 October 2026.

Which rules did each organisation break?

The ICO found that ONL infringed Articles 32(1)(b) and 32(1)(d) of the UK GDPR. Those require organisations to keep their systems confidential and secure, and to test regularly whether their security measures work.

According to the ICO, ONL created the account “in January 2012 with the password ‘Password1′” without applying password-strength rules. It did not regularly audit the accounts it had created on Data Cymru’s network, so the unneeded account survived “for more than 12 years, including over six years after ONL’s obligations under the GDPR came into effect”.

It also never reviewed local administrator accounts after setting them up. On three affected systems, those accounts kept the same password for more than 12 years, the ICO said. The Register, quoting the reprimand, says that let the attacker reuse credentials to reach other systems once one was breached.

Data Cymru infringed Articles 28(4), 32(1)(b) and 32(1)(d), the ICO found. Article 28(4) covers the contract terms required when a data processor brings in a sub-processor. The ICO said Data Cymru had no contract with ONL containing those legally required terms.

It also did not clearly document how ONL’s Active Directory services would be delivered, monitored or audited, failed to make sure the dormant account was removed or brought up to its newer password rules, and ran account reviews that “were not scheduled or routine”. “The infringements by both organisations continued without being identified or addressed,” the ICO said.

What did the ICO say?

“Password1 is not an appropriate password, it is a wide-open door to nefarious actors,” said David Doodson, the ICO’s head of investigations.

He said responsibility “did not sit with one organisation alone”: ONL created the account, while Data Cymru kept overall control of its network. “Basic cyber security controls are not optional, and the negative consequences of not having them can be severe,” he said.

Since the attack, ONL has started prompting customers to review active accounts and added multi-factor authentication, the ICO said. On 30 April 2025, the two organisations signed a legally compliant data processing contract, and Data Cymru has also introduced periodic account reviews and multi-factor authentication.

The ICO’s advice to other organisations includes removing unused test and dormant accounts, blocking common passwords, putting multi-factor authentication on remote access, and spelling out security duties in contracts with IT providers.

The release notes that, since 30 September 2026, the ICO acts on behalf of the new Information Commission, which replaced the office of the Information Commissioner.

Our read

This is TSN’s analysis. The failure was not sophisticated, and that is the point: a 2012 test account outlived everyone’s attention. The case also shows how outsourcing can blur responsibility, a theme behind the UK’s proposed bill to bring managed service providers under cyber rules. A reprimand carries no penalty, so the real test is whether other public-sector suppliers audit their own old accounts.