On October 20, 2026, the Information Commissioner's Office (ICO) reprimanded Ogi Networks Limited and Data Cymru after a ransomware attack on November 1, 2024. The investigation linked the intrusion to an old test account protected by “Password1” that had remained active or been mistakenly reactivated for more than twelve years.
Personal information about 3,300 people was taken, most of them children. This was not just a weak-password failure: the ICO also found incomplete account reviews and unclear security responsibilities between the public-sector organisation and its IT provider.
What the ICO found
The attack took place on November 1, 2024. According to the ICO, the ransomware encrypted 182.7 GB of data and 42 GB was taken from Data Cymru systems. The information related to two projects supporting children and families. The regulator announced its reprimands on October 20, 2026, after examining the security of processing by both organisations.
In March 2025, the BBC had already reported that data about children looked after by Cardiff had been compromised in a breach affecting Data Cymru. The Isle of Anglesey County Council's report also describes the incident's impact on social-care services in Wales. The ICO's announcement today adds its regulatory findings and the overall figure of 3,300 people.
A test account remained for twelve years
The “Test2” account was created in January 2012 with the password “Password1”. The ICO could not establish whether it had remained active since its creation or had been inadvertently reactivated before the attack. A third-party password-strength tool rated it very weak and estimated that it could be compromised in less than a second.
The problem extended beyond that account: local administrator passwords on three affected systems had not changed for more than twelve years. Ogi Networks did not regularly audit the accounts it had created on Data Cymru's network. Data Cymru, in turn, conducted irregular reviews that did not cover its entire Active Directory.
The data related to children and families
The ICO says personal information about 3,300 people was taken, most of them children. The data related to two projects supporting children and families. The regulator's public decision does not list every data category taken for each person, so it would be inaccurate to say that all records were detailed social-care files or that the data was published online.
The BBC had previously reported a risk to information about children looked after by Cardiff Council. That reporting shows the sensitivity of the services involved, but it does not support extending the BBC's described data categories to all 3,300 people mentioned by the ICO.
The client and provider shared responsibility
Ogi Networks created the test account. Data Cymru retained overall control of its network and could instruct Ogi to create or remove accounts. The ICO found that the two organisations had not established sufficiently clear and effective measures to identify and remove old accounts.
The regulator also found that, at the relevant time, there was no contract containing the required data-processing terms for the sub-processor, and that monitoring and audit responsibilities for the Active Directory service were unclear. Since the incident, the organisations have signed a data-processing contract, introduced periodic account reviews and strengthened access controls, including multi-factor authentication.
Controls organisations should put in place
For organisations, the lesson is about the full access lifecycle. Inventory user, test, service and administrator accounts; identify an owner and check when each was last used; then disable any account that no longer has a purpose. Privileged accounts need unique secrets, rotation after an incident and multi-factor authentication for remote access.
When a provider administers accounts in your environment, the contract should specify who creates, reviews and removes them, and how those actions are checked. A useful review covers the full directory, local accounts and elevated permissions, rather than a sample of the accounts visible to the reviewer. After the incident, Data Cymru and Ogi said they had added periodic reviews and strengthened authentication.
How Soclyde relates to this case
Soclyde helps teams generate and store unique passwords in an encrypted local-first vault. This can reduce the chance that one weak or reused secret unlocks several services. The vault does not identify dormant accounts in Active Directory, disable a provider's account, or replace multi-factor authentication and access reviews.
For a practical way to review how shared secrets are handled, read the password-manager security audit guide. Accounts still need to be reviewed and removed in each relevant service and directory.
Key points
The Data Cymru attack exposed information about 3,300 people, most of them children, after an old test account protected by a very weak password remained active or was reactivated. The ICO reprimanded both Data Cymru and Ogi Networks, emphasizing that account controls and provider responsibilities must be managed together.
Inventory accounts created by your team and providers, remove those that are no longer needed, and document review responsibilities in procedures and contracts. To assess how your organisation handles shared secrets, start with the password-manager security audit guide or contact Soclyde.
