Weak password on legacy test account leads to ransomware breach affecting thousands of children
A ransomware attack on Ogi Networks Limited and Data Cymru exposed the data of about 3,300 people, mostly children, after a test account protected only by the password “Password1” was compromised.
On November 1, 2024, a ransomware incident hit Welsh broadband provider Ogi Networks Limited and the local-government data unit Data Cymru, stealing data belonging to roughly 3,300 individuals, the majority of whom were children. Investigators traced the intrusion to a test account named “Test2”, created in January 2012 and protected only by the password “Password1”, which a password-strength tool deemed very weak. The attack encrypted 182.7 GB of data, with 42 GB taken from Data Cymru’s systems, compromising details from two projects serving children and families.
The Information Commissioner’s Office issued a GDPR reprimand and mandated stronger safeguards, prompting both organisations to adopt multi-factor authentication, periodic account reviews, and clearer contractual responsibilities for security. Ogi Networks Limited also engaged independent cyber-security specialists and disabled unnecessary accounts within a week of the breach. Data Cymru, now merged into the WLGA, affirmed that the stolen information has not been further shared or misused.
Why it matters
It shows how a single weak password can expose sensitive data of thousands, highlighting the need for robust cyber-security practices.
In this story
