A Forgotten Password Left 3,300 People Exposed. Most of Them Were Children.

A ransomware attack that struck two Welsh organizations last November came down to a single dormant account, a password no one had changed in over a decade, and a security review that never happened. The result: personal information belonging to roughly 3,300 people, the majority of them minors, was stolen and encrypted by attackers who walked through a door that should have been closed years earlier.

The UK's Information Commissioner's Office has now reprimanded both organizations, Ogi Networks Limited and Data Cymru, for breaching data protection rules. The findings, released following an investigation into the November 1, 2024 attack, describe a failure rooted not in sophisticated hacking techniques but in neglect.

The password on the compromised account was "Password1." Security researchers estimate it could be cracked in under a second. The account itself had been created in 2012 as a test account and then forgotten. No one audited it. No one removed it. For more than a decade it sat on the network, accessible to anyone who found it and tried the obvious.

Attackers did find it. They used it to encrypt 182.7 gigabytes of data and steal 42 gigabytes from Data Cymru's systems. The people whose information was taken had no say in how it was stored or protected. Many of them were children enrolled in programs designed to support young people and families in Wales.

David Doodson, head of investigations at the ICO, said the incident illustrated how a single weak password on an unnecessary account could enable a serious attack touching thousands of lives. The ICO framed the case as instructive for any organization that holds sensitive personal data, not just those involved here.

The investigation identified a set of overlapping failures that allowed the breach to happen. Ogi Networks Limited, which provided network services to Data Cymru, had not reviewed its local administrator accounts. That gap left the test account active and unmonitored. Data Cymru, which collected and held the personal data, had not put a data protection agreement in place with ONL, meaning responsibility for securing the shared infrastructure was never clearly assigned. Neither organization had conducted the kind of regular security review that would likely have caught either problem.

UK GDPR rules require organizations to take appropriate technical and organizational measures to protect personal data. The ICO found that both organizations fell short of that standard. ONL has since acknowledged the failure directly, stating that the account should have been removed long before it was discovered and exploited.

Both organizations have moved to address the vulnerabilities. ONL brought in independent cybersecurity specialists and worked with Data Cymru to audit every account on the network, disabling those no longer in use. Data Cymru, which merged with the Welsh Local Government Association in 2025, implemented multi-factor authentication for remote access, introduced periodic account reviews, and entered into a legally compliant data processing contract with its service provider. These are standard measures, widely recommended and not technically difficult to carry out. They were simply not in place when the attack happened.

The ICO's recommendations in response to the case are equally standard: use strong passwords, require multi-factor authentication, review user accounts regularly, and establish clear contractual responsibility for cybersecurity when services are outsourced. None of these represent new thinking. They appear in basic guidance that has been publicly available for years. What the Welsh case demonstrates is the distance between knowing what good practice looks like and actually maintaining it over time.

That gap tends to widen around accounts and systems that no one is actively using. A test account created for a short-term purpose in 2012 would have been easy to deprioritize. No one relied on it. No one thought about it. It generated no errors and triggered no alerts. It simply persisted, waiting.

Organizations accumulate this kind of technical residue over years. Old accounts, unused credentials, legacy systems that were meant to be temporary. Each one represents a potential point of entry. Addressing it requires not a one-time effort but sustained, deliberate attention, the kind that rarely feels urgent until something goes wrong.

The breach at Data Cymru and ONL was not the result of an exceptionally capable attacker or an unusually complex target. The tools needed to prevent it existed, were well documented, and were available to both organizations without significant cost. What was missing was the discipline to apply them consistently and the oversight structure to ensure someone remained responsible for doing so.

The children whose records were taken had no control over any of this. They did not choose the organizations that held their data or the infrastructure those organizations used. They participated in programs meant to help them, and in doing so their personal information passed into systems that were not adequately protected. The expectation, and the legal obligation, is that organizations receiving that kind of trust will treat it accordingly.

The ICO's findings name this as a failure of maintenance and process rather than a failure of technology. That distinction matters. It means the lesson is not about investing in more sophisticated tools. It is about doing the less glamorous work of keeping existing systems clean, current, and regularly examined.

Old accounts do not stay harmless simply because they are old. They stay harmless only if someone makes sure they are gone.

---