ICO Reprimands Ogi Networks, Data Cymru After 'Password1' Account Exposes 3,300 People's Data

3.3 · 10d ago · WORLD · TECH

The Facts

  • The UK Information Commissioner's Office (ICO) reprimanded Ogi Networks Limited (ONL) and Data Cymru over a cyber-attack on 1 November 2024. BBC only
  • The attack exposed personal information of 3,300 people, mostly children, linked to two projects supporting children and families. BBC only
  • Hackers accessed a test account called Test2, created by ONL in 2012 and protected by the password 'Password1', which went unaudited and unremoved for more than 12 years. BBC only
  • In the ransomware attack, hackers encrypted 182.7GB of data and stole 42GB from Data Cymru's systems. BBC only
  • The ICO found both organisations breached UK GDPR by failing to properly protect systems and not regularly checking whether security measures were effective. BBC only
Dive deeper · 5 more factsShow less
  • Local administrator accounts on three affected systems used the same password for the same period, and ONL did not review them after deployment. BBC only
  • Data Cymru did not have a data protection agreement with ONL and did not ensure the dormant test account was identified and removed; a compliant data processing contract was signed on 30 April 2025. BBC only
  • Both organisations have since introduced multi-factor authentication and periodic account reviews. BBC only
  • Data Cymru merged with the Welsh Local Government Association (WLGA) in 2025; WLGA said there was no evidence the stolen data was shared further or misused. BBC only
  • ONL said the breach was limited to the server it hosted for Data Cymru and no other customer information was affected. BBC only

Context

The ICO issued reprimands to IT provider Ogi Networks Limited and Data Cymru following a ransomware attack in November 2024 that exposed data on 3,300 people, mostly children. The attack used a test account created in 2012 with the password 'Password1'.

The ICO said responsibility did not rest with one organisation, citing a gap in responsibility between the two. ONL said it accepted the findings and had acted on them.

How the Agent Panel Scored This

Independent AI personas each scored importance 1–10; the story's score is a trimmed mean (highest and lowest votes dropped). Vote spread: 1.

4 News Editor A regulatory reprimand over a ransomware breach exposing 3,300 mostly children's records is a concrete action with real but limited, regional impact and no widespread immediate effect.
3 Business Analyst This is a regulatory reprimand (not a fine) over a ransomware breach affecting 3,300 people, a niche enforcement action with limited broader market or economic impact.
3 Informed Citizen This is a regulatory reprimand over a past breach affecting 3,300 people, with no new broad consequences for the public and limited lasting impact beyond the affected individuals and the organisations involved.

Source

← All stories