Threat reportRansomwareTL-2026-3992
Ransomware attack on Data Cymru via weak 'Test2'/'Password1' test account at Ogi Networks leads to theft of children's data
Ransomware attack on Data Cymru via weak 'Test2'/'Password1' (TL-2026-3992) is a medium-severity ransomware operation, first published 2026-10-20 and last reviewed 2026-10-21. It has no confirmed attribution, affects Ogi Networks Limited Managed IT infrastructure and Active Directory, maps to 6 MITRE ATT&CK techniques (T1005, T1021, T1078), and is covered by 9 detection rules and 8 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3992
- Threat ID
- TL-2026-3992
- Severity
- MEDIUM
- Status
- RESOLVED
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, local-government, social-care, children-services
- Target regions
- united kingdom, Wales
- Detection rules
- 9
- Indicators of compromise
- 8
- Updates
- 2026-10-21 · revalidated 1× · latest source
How Ransomware attack on Data Cymru via weak 'Test2'/'Password1' works
A ransomware attack on 1 November 2024 abused a 12-year-old, never-removed test account ('Test2', password 'Password1') managed by IT provider Ogi Networks Limited, leading to theft of personal data on about 3,300 people, mostly children, from Local Government Data Unit - Wales (Data Cymru) systems. The UK ICO issued reprimands (no fines) to both organisations.
On 1 November 2024 an unidentified ransomware operator gained access to infrastructure run by Ogi Networks Limited (ONL) on behalf of the Local Government Data Unit - Wales (Data Cymru). According to the ICO findings as reported by The Register, Herald.Wales, Cypro and Local Government Lawyer, initial access used a test account named 'Test2' that had been created on 13 January 2012 and never decommissioned or updated. Its password, 'Password1', was rated 'very weak' by an independent password-strength tool (Bitwarden), with an estimated cracking time of less than a second.
From this foothold the attacker reached the primary domain controller, a file server and an SQL server. Cypro's summary describes lateral movement using shared local administrator credentials: the ICO found local administrator accounts on three systems shared identical passwords, and had not been reviewed in more than 12.5 years. About 42 GB of data was exfiltrated and 182.7 GB was encrypted on the file server and internal database server. No ransomware family, threat actor, CVE or network indicator has been publicly named.
The affected data, drawn from two projects supporting children and families, relates to about 3,300 individuals, the large majority children. Reported data types include names, dates of birth, care placement details, care-provider information and addresses of care settings. The ICO noted no evidence of further sharing or misuse.
The ICO issued reprimands (not fines) on 14 October 2026, announced 20 October 2026. ONL was found in breach of UK GDPR Article 32: no audit or review of Active Directory user accounts, weak password controls for the test account, shared local administrator passwords, and insufficient testing of security effectiveness. Data Cymru was found in breach of Articles 32 and 28: it failed to instruct removal of the dormant account, had incomplete account reviews, inadequate documentation of Active Directory service delivery/monitoring, and lacked a compliant sub-processor contract with ONL. ICO Head David Doodson stated: 'Password1 is not an appropriate password, it is a wide-open door to nefarious actors.' ONL has since introduced a customer account-review procedure and strengthened access controls including multi-factor authentication.
MITRE ATT&CK techniques used in TL-2026-3992
Collection
Lateral Movement
Initial Access
Persistence
T1078.002 Valid Accounts: Domain Accounts
Privilege Escalation
T1078.003 Valid Accounts: Local Accounts
Impact
Affected products and versions in Ransomware attack on Data Cymru via weak 'Test2'/'Password1'
- Ogi Networks Limited — Managed IT infrastructure and Active Directory services hosted for Data Cymru
Vulnerable versions: Test2 account created 2012-01-13; shared local administrator passwords on three systems
Fixed in: MFA and account-review procedures introduced after incident - Local Government Data Unit - Wales (Data Cymru) — Domain controller, file server and SQL server holding children and family project data
Vulnerable versions: Systems as of 2024-11-01
Remediation for Ransomware attack on Data Cymru via weak 'Test2'/'Password1'
Immediate actions
- Disable or delete dormant, test and unused accounts, including in Active Directory
- Block weak and common passwords such as 'Password1' in password policy
- Replace shared local administrator passwords with unique per-host credentials (e.g. LAPS-style management)
Workarounds
- Apply multi-factor authentication to remote access and privileged accounts
Longer-term hardening
- Schedule routine reviews of all accounts, permissions and security groups
- Enable auditing of Active Directory user accounts and alert on logons from stale accounts
- Define IT-provider account-management responsibilities and sub-processor terms in contracts
- Test and evaluate the effectiveness of security measures regularly
Weaknesses (CWE) in Ransomware attack on Data Cymru via weak 'Test2'/'Password1'
Timeline of Ransomware attack on Data Cymru via weak 'Test2'/'Password1'
- ONL creates the 'Test2' account with password 'Password1'; it is never removed, updated or reviewed over the following 12+ years.
- Ransomware encrypts 182.7 GB on the file server and internal database server; Data Cymru reports a cybersecurity incident disrupting operations.
- About 42 GB is exfiltrated from the primary domain controller, a file server and an SQL server; shared local administrator passwords across three systems aided movement.
- Attacker abuses the Test2 test account to gain access to ONL-managed infrastructure serving Data Cymru.
- Early public reporting of the incident emerges (per Cypro, 27-28 March 2025; original report not independently verified).
- Data Cymru and Ogi Networks execute a compliant data processing contract, remedying the missing UK GDPR Article 28(4) sub-processor terms.
- ICO issues reprimands (no fines) to ONL (UK GDPR Art. 32) and Data Cymru (Arts. 32 and 28), per Cypro's reporting.
- ICO findings made public; The Register, Herald.Wales and others report ~3,300 individuals, mostly children, affected.
Update history for TL-2026-3992
- 2026-10-21 — Ransomware via forgotten 'Test2' account with password 'Password1' leads to ICO reprimands for Ogi Networks Limited and Data Cymru: What changed No severity, exploitability or status change; existing record already reflects the core facts. Additive details only. New indicators (4) Test2 and Password1 as behavioural hunt/deny-list indicators, Windows file server asset, a
Sources cited for Ransomware attack on Data Cymru via weak 'Test2'/'Password1'
- 'Password1' and a forgotten test account land Welsh outfits in hot water (The Register)
- ICO reprimand: Ogi Networks Limited
- ICO reprimand: Local Government Data Unit - Wales
- Ogi and Data Cymru reprimanded over 'Password1' breach of children's data (Herald.Wales)
- Data Cymru Ransomware Draws ICO Reprimands (Cypro)
- ICO reprimands two Welsh organisations including local government company after cyber attack (Local Government Lawyer)
- Welsh firms 'Password1' and 'Test 2' fails led to hackers stealing children's data (Daily Post)
- Data Cymru has been the victim of a cybersecurity incident (Data Cymru notice)
Detection coverage for TL-2026-3992
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3992 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.