ICO reprimands Ogi Networks and Data Cymru over 2024 ransomware attack via forgotten 'Password1' test account
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 21/10/2026 11:58; os links antigos trazem para cá.
The UK Information Commissioner's Office (ICO) has issued reprimands, not fines, to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales (Data Cymru) over a ransomware attack on 1 November 2024 (theregister.com, infosecurity-magazine.com). The intruder entered Data Cymru's network through a forgotten test account, Test2 (written 'Test 2' in one source), created in January 2012 and protected only by the password Password1 (theregister.com). Personal data of about 3,300 people, mostly children, linked to two projects supporting children and families, was stolen, and 182.7 GB was encrypted (theregister.com, infosecurity-magazine.com). The ICO found ONL breached Article 32 of the UK GDPR and said responsibility was shared, because Data Cymru kept overall control of its network (theregister.com). No financial penalty was imposed, citing the remedial action taken (infosecurity-magazine.com). Neither source names the ransomware family or the threat actor.
Timeline
- 2012-01: The Test2 account and the default local administrator password on the three affected systems are set; neither is changed for more than 12.5 years (theregister.com).
- 2024-11-01: Ransomware attack on Data Cymru. Data is exfiltrated and then encrypted (theregister.com, infosecurity-magazine.com).
- 2026-10-20: The ICO reprimands ONL and Data Cymru, with no fines (theregister.com).
- 2026-10-21: Further coverage adds the governance failings and the remediation already carried out (infosecurity-magazine.com).
Technical Details
- Initial access: the valid, operationally unnecessary Test2 account with the password "Password1". Bitwarden's tool rates it "very weak", with a cracking time under one second. It had no password strength or complexity requirements (theregister.com, infosecurity-magazine.com).
- Lateral movement potential: the local administrator accounts on the three affected systems shared the same default password, unchanged since January 2012. Once one system was breached, the local account hashes could be collected and used to authenticate to other systems (theregister.com).
- Exfiltration: 42 GB was taken from a primary domain controller, a file server and an SQL server before the ransomware was deployed (theregister.com, infosecurity-magazine.com).
- Impact: 182.7 GB was encrypted on a file server and an internal database server (theregister.com, infosecurity-magazine.com).
- ONL failings: no review of local administrator accounts after deployment, no auditing procedures for user accounts in Data Cymru's Active Directory, and no regular audits of the accounts it had created (theregister.com, infosecurity-magazine.com).
- Data Cymru governance failings: no contract with ONL containing the mandatory data protection terms for a sub-processor, and account reviews that were unscheduled and did not cover the full contents of Active Directory (infosecurity-magazine.com).
Remediation
- Routinely identify and remove unused, test and legacy accounts, and regularly review Active Directory and local administrator accounts (theregister.com, infosecurity-magazine.com).
- Replace default and shared passwords, and use unique local administrator credentials on each system (theregister.com).
- Enforce strong passwords and protect remote access with multi-factor authentication (infosecurity-magazine.com).
- Define clearly who is responsible for creating and removing accounts, and for cyber security, between service providers and customers, and put compliant data processing contracts in place (theregister.com, infosecurity-magazine.com).
- Actions already taken: ONL strengthened its account access controls, and Data Cymru and ONL entered into a legally compliant data processing contract (infosecurity-magazine.com).
Linha do tempo
-
Ransomware hits Data Cymru in Wales via 12-year-old 'Test 2' account with 'Password1'; ICO reprimands Data Cymru and ONL
ler a análise desta fonte ocultar
The UK Information Commissioner's Office (ICO) has reprimanded Data Cymru (Local Government Data Unit – Wales) and its IT provider Ogi Networks Limited (ONL) over a November 2024 ransomware attack. The attackers gained access through a legacy test account, 'Test 2', which had existed for more than 12 years and was protected only by the password 'Password1'. They exfiltrated 42GB of data and encrypted 182.7GB. The stolen data related to two projects supporting children and families and included the personal data of 3,300 people, most of them children. The ICO found infringements of UK GDPR but issued no financial penalty, citing the remedial action taken.
Technical Details
- Initial access: the compromised 'Test 2' account, which was operationally unnecessary and protected only by a weak password.
- Exfiltration: 42GB was taken from a primary domain controller, a file server and an SQL server before the ransomware was deployed.
- Impact: 182.7GB was encrypted on file servers and an internal SQL database server.
- Failings identified: no password-strength or complexity requirements on the account, no regular audits of accounts ONL had created, and no review of local administrator accounts after deployment.
- Governance failings: Data Cymru had no contract with ONL containing the mandatory data protection terms for a sub-processor, and its account reviews were unscheduled and did not cover the full contents of Active Directory.
- The article does not name the ransomware family or the threat actor.
Remediation
- Enforce strong passwords and protect remote access with multi-factor authentication.
- Regularly review and remove unneeded user, test and local administrator accounts, including the full Active Directory.
- Define clearly who is responsible for cyber security when services are outsourced, and put compliant data processing contracts in place.
- ONL strengthened its account access controls, and Data Cymru and ONL entered into a legally compliant data processing contract.
-
ICO reprimands Ogi Networks and Data Cymru after ransomware breach via 'Password1' test account exposed 3,300 people
ler a análise desta fonte ocultar
The UK Information Commission's Office (ICO) issued reprimands, not fines, to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales (Data Cymru) after a ransomware attack on 1 November 2024. The intruder used a forgotten test account, Test2, created in January 2012 with the password "Password1", to enter Data Cymru's network. Personal data relating to about 3,300 people, mostly children, was stolen, and 182.7 GB of data was encrypted. The ICO found ONL breached Article 32 of the UK GDPR and said responsibility was shared, because Data Cymru retained overall control of its network. The article does not name the ransomware group.
Technical Details
- Initial access used the valid test account Test2, which had the password "Password1". Bitwarden's tool rates this "very weak", with a cracking time under one second.
- The local administrator accounts on the three affected systems shared the same default password, set in January 2012 and unchanged for more than 12.5 years. Once one system was breached, the local account hashes could be collected and used to authenticate to other systems.
- Before deploying the ransomware, the threat actor exfiltrated 42 GB of data from a primary domain controller, a file server and an SQL server.
- 182.7 GB of data was encrypted on a file server and an internal database server.
- ONL did not review local administrator accounts after deployment and had no auditing procedures for user accounts in Data Cymru's Active Directory.
Remediation
- Routinely identify and remove unused, test and legacy accounts.
- Replace default and shared passwords, and use unique local administrator credentials on each system.
- Review Active Directory and local administrator accounts regularly.
- Define clearly who is responsible for creating and removing accounts between service providers and their customers.