# Ransomware attack on Data Cymru via weak 'Test2'/'Password1' test account at Ogi Networks leads to theft of children's data

> A ransomware attack on 1 November 2024 abused a 12-year-old, never-removed test account ('Test2', password 'Password1') managed by IT provider Ogi Networks Limited, leading to theft of personal data on about 3,300 people, mostly children, from Local Government Data Unit - Wales (Data Cymru) systems. The UK ICO issued reprimands (no fines) to both organisations.

- **Published:** 2026-10-20T22:47:12Z
- **Last reviewed:** 2026-10-21T00:33:39.908Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3992
- **ID:** TL-2026-3992
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** RESOLVED
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 1 November 2024 an unidentified ransomware operator gained access to infrastructure run by Ogi Networks Limited (ONL) on behalf of the Local Government Data Unit - Wales (Data Cymru). According to the ICO findings as reported by The Register, Herald.Wales, Cypro and Local Government Lawyer, initial access used a test account named 'Test2' that had been created on 13 January 2012 and never decommissioned or updated. Its password, 'Password1', was rated 'very weak' by an independent password-strength tool (Bitwarden), with an estimated cracking time of less than a second.

From this foothold the attacker reached the primary domain controller, a file server and an SQL server. Cypro's summary describes lateral movement using shared local administrator credentials: the ICO found local administrator accounts on three systems shared identical passwords, and had not been reviewed in more than 12.5 years. About 42 GB of data was exfiltrated and 182.7 GB was encrypted on the file server and internal database server. No ransomware family, threat actor, CVE or network indicator has been publicly named.

The affected data, drawn from two projects supporting children and families, relates to about 3,300 individuals, the large majority children. Reported data types include names, dates of birth, care placement details, care-provider information and addresses of care settings. The ICO noted no evidence of further sharing or misuse.

The ICO issued reprimands (not fines) on 14 October 2026, announced 20 October 2026. ONL was found in breach of UK GDPR Article 32: no audit or review of Active Directory user accounts, weak password controls for the test account, shared local administrator passwords, and insufficient testing of security effectiveness. Data Cymru was found in breach of Articles 32 and 28: it failed to instruct removal of the dormant account, had incomplete account reviews, inadequate documentation of Active Directory service delivery/monitoring, and lacked a compliant sub-processor contract with ONL. ICO Head David Doodson stated: 'Password1 is not an appropriate password, it is a wide-open door to nefarious actors.' ONL has since introduced a customer account-review procedure and strengthened access controls including multi-factor authentication.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1078.002 Valid Accounts: Domain Accounts
- T1078.003 Valid Accounts: Local Accounts
- T1021 Remote Services
- T1005 Data from Local System
- T1486 Data Encrypted for Impact

## Sources

- ['Password1' and a forgotten test account land Welsh outfits in hot water (The Register)](https://www.theregister.com/cyber-crime/2026/10/20/password1-and-a-forgotten-test-account-land-welsh-outfits-in-hot-water/5304139)
- [ICO reprimand: Ogi Networks Limited](https://ico.org.uk/media2/u5jfleom/ogi-networks-limited-reprimand-english.pdf)
- [ICO reprimand: Local Government Data Unit - Wales](https://ico.org.uk/media2/4peg3pul/local-government-data-unit-wales-reprimand.pdf)
- [Ogi and Data Cymru reprimanded over 'Password1' breach of children's data (Herald.Wales)](https://herald.wales/national-news/ogi-data-cymru-password1-childrens-data-breach/)
- [Data Cymru Ransomware Draws ICO Reprimands (Cypro)](https://cypro.co.uk/insights/cyber-bulletins/data-cymru-ransomware-draws-ico-reprimands/)
- [ICO reprimands two Welsh organisations including local government company after cyber attack (Local Government Lawyer)](https://www.localgovernmentlawyer.co.uk/information-law/398-information-law-news/102013-ico-reprimands-two-welsh-organisations-including-local-government-company-after-cyber-attack)
- [Welsh firms 'Password1' and 'Test 2' fails led to hackers stealing children's data (Daily Post)](https://www.dailypost.co.uk/news/north-wales-news/welsh-firms-password1-test-2-34791209)
- [Data Cymru has been the victim of a cybersecurity incident (Data Cymru notice)](https://dataunitwales.gov.uk/data-cymru-has-been-the-victim-of-a-cybersecurity-incident)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3992