ICO reprimands Welsh orgs after 'Password1' test account breach

The UK ICO issued reprimands to Ogi Networks and Data Cymru after a November 2024 ransomware attack. An intruder entered via a test account named Test2 protected by "Password1", exfiltrated 42 GB and encrypted 182.7 GB, affecting 3,300 people, mostly children.

• Test2 account with password "Password1" was created in 2012 and left active for 12.5 years
• 42 GB exfiltrated and 182.7 GB encrypted on Data Cymru servers
• Local admin accounts on three systems shared the same password
• ICO issued reprimands rather than fines to both organizations