A Forgotten Test Account Helped Expose 3,300 People’s Data in Ransomware Attack

A test account created more than 12 years earlier was still a security risk when attackers struck two Welsh organizations. Most of the people affected were children.

A forgotten test account protected by the password Password1 helped expose personal information belonging to 3,300 people in a ransomware attack involving two Welsh organisations. Most of those affected were children.

The UK’s Information Commissioner’s Office (ICO) announced on 20 October 2026 that it had reprimanded Ogi Networks Limited (ONL), an IT service provider, and the Local Government Data Unit – Wales, known as Data Cymru, over security failures linked to the incident.

The attack happened on 1 November 2024, nearly two years before the regulator publicly detailed its findings. Its investigation identified more than a weak password: an unnecessary account had remained in existence for years, administrator accounts shared a long-standing password, account reviews were inadequate, and the organisations had not clearly established their respective security responsibilities.

The case shows how several overlooked security weaknesses can combine to expose personal information on a significant scale.

How a test account became a security risk

The story began in January 2012, when Ogi Networks created a test account named Test2 while working on Data Cymru’s network. The account was likely intended to test user access before real users were moved to the service.

Test accounts can be useful during setup and maintenance. The risk arises when an account is no longer needed but remains available without regular checks.

According to the ICO, the Test2 account had either remained active since its creation or been inadvertently reactivated before the attack. It was protected by the password Password1.

The regulator said a third-party password-strength tool classified the password as very weak and estimated that it could be compromised in less than a second.

The account had remained in existence for more than 12 years, including over six years after ONL’s obligations under the General Data Protection Regulation came into effect. Neither organisation had sufficiently effective processes to ensure that unnecessary accounts were routinely identified and removed.

The problem was therefore not simply that the password was weak. An account created for a specific purpose had remained a potential route into the network long after it should have been reviewed.

Source: ICO’s official investigation

1 November 2024: Attackers steal data and encrypt systems

On 1 November 2024, an attacker exploited the test account in a ransomware attack affecting Data Cymru’s systems.

The ICO reported that the attack encrypted approximately 182.7GB of data and that 42GB of data was taken from Data Cymru’s systems. The compromised information related to two projects supporting children and families.

These figures describe two different consequences of the incident: data was encrypted, while a smaller volume was taken. They should not be interpreted as meaning that all 182.7GB of encrypted information was stolen.

The test account was not the only security weakness identified in the investigation. The ICO found that local administrator accounts on three affected systems had retained the same password for more than 12 years.

That created a further risk. According to the regulator, once one system had been compromised, the attacker could collect local account password hashes and use them to authenticate to other systems on the network.

In simple terms, the shared administrator password meant that compromising one system could help an attacker gain access to others. The incident was not just about one neglected login. Other long-standing weaknesses made it harder to contain the consequences of an initial compromise.

The personal information taken belonged to 3,300 people, with children accounting for the majority.

The ICO’s findings do not establish that every affected person subsequently suffered identity theft or that the stolen information was published online. Those are separate claims and should not be assumed simply because data was taken.

The failures went beyond one weak password

The ICO found security failings at both organisations, although their responsibilities differed.

Ogi Networks Limited had created the Test2 account but failed to carry out regular audits of the accounts it had created within Data Cymru’s network. It also did not apply appropriate password-strength and complexity requirements to the test account.

ONL had not reviewed local administrator accounts after their initial deployment, allowing accounts on three affected systems to retain the same password for more than 12 years.

Data Cymru, meanwhile, retained overall control of its network, including the ability to instruct Ogi Networks to create or remove accounts. Yet its account reviews were not scheduled or routine and did not cover the full contents of its Active Directory environment, which manages user accounts and access permissions.

The ICO also found that Data Cymru had not ensured that the dormant test account was removed or updated to meet stronger password requirements introduced later.

There was a contractual problem, too. Data Cymru did not have the legally required data protection terms in place with ONL for the relevant subcontracting arrangement. The organisations had also failed to document clearly how the Active Directory service would be delivered, monitored and audited.

These failures were connected, but they were not identical. ONL created the test account and did not regularly audit the accounts it had created. Data Cymru retained overall control of its network but did not adequately review its accounts or clearly document the division of responsibilities.

The ICO’s findings therefore point to a broader failure of security management, rather than a single mistake by an individual.

What happened after the attack?

Following the incident, the organisations introduced changes to their security arrangements.

An ONL spokesperson told the BBC that the test account should have been removed long before criminals were able to use it. The company said it accepted the ICO’s findings and had acted on them.

According to ONL, within a week of the attack it worked with Data Cymru to check every account on the network and disable accounts that were no longer needed. It also said it brought in independent cybersecurity specialists to investigate.

ONL subsequently introduced regular account reviews for customers whose networks it manages and strengthened remote-access security with multi-factor authentication. It said the incident was limited to the server it hosted for Data Cymru and that no other customer information held by ONL was affected.

Data Cymru also introduced periodic account reviews and strengthened access controls, including multi-factor authentication. On 30 April 2025, the two organisations entered into a legally compliant data-processing contract.

These measures addressed weaknesses identified after the attack. They did not, however, undo the earlier theft of personal information.

October 2026: The ICO issues its reprimands

On 20 October 2026, the ICO publicly announced reprimands for both organisations.

It found that ONL had breached provisions of the UK GDPR concerning the security of processing and the regular testing and evaluation of security measures.

Data Cymru was found to have breached provisions concerning its arrangements with a processor, the security of processing, and the testing and evaluation of security measures.

The ICO issued reprimands rather than financial penalties in this action. A reprimand is a formal regulatory measure; it should not be described as a fine.

David Doodson, the ICO’s Head of Investigations, said: “Password1 is not an appropriate password, it is a wide-open door to nefarious actors.”

He also emphasised that responsibility for the failures did not rest with one organisation alone. Both had failed to put sufficiently clear and effective measures in place to ensure that old accounts were routinely identified and removed.

The regulatory action came after the organisations had introduced security improvements. The ICO’s findings nevertheless showed that the earlier failures had continued without being identified or addressed.

Was the stolen information misused?

The ICO confirmed that personal information relating to 3,300 people was taken, most of them children. Its public announcement did not establish that the information had subsequently been published or misused.

There is an important qualification to that finding.

Data Cymru’s staff and functions were transferred to the Welsh Local Government Association (WLGA) in 2025. In a statement reported by the BBC, the WLGA said there was no evidence that the compromised information had been shared further or misused.

The association also said measures had been introduced to strengthen information governance, remove dormant accounts, improve password and remote-access controls, and clarify contractual responsibilities for security and audits.

The statement provides useful context for people concerned about the incident. However, an absence of evidence of further misuse is not the same as proof that misuse was impossible. The confirmed fact remains that personal information was taken during the attack.

For anyone who believes they may have been affected, the appropriate step is to follow direct communications from the relevant organisation and use its official contact channels to ask what information was involved. Unexpected messages claiming to offer help after a breach should be treated cautiously, especially if they request passwords, payment or identity documents.

Source: BBC reporting on the incident and organisations’ responses

The bigger lesson: forgotten access can become a lasting risk

The most important lesson from this incident is not that one password was weak. It is that an account created for testing in 2012 remained a security risk more than a decade later, while shared administrator credentials, inadequate account reviews and unclear security responsibilities went unaddressed.

A stronger password could have made the test account harder to compromise, but it would not have made an unnecessary account appropriate to keep. Removing the account would have eliminated that particular route, while reviewing administrator accounts and using unique credentials could have reduced the risk of an attacker moving between systems.

The case also shows why organisations using external IT providers need clear oversight of access and security controls. Responsibility must be documented, accounts must be reviewed, and security measures must be checked rather than simply assumed to be effective.

The attack occurred in November 2024, but the ICO’s findings, announced in October 2026, reveal how basic security weaknesses can remain hidden for years.

A test account should be temporary. In this case, leaving one behind helped expose personal information belonging to thousands of people, most of them children.