ICO reprimands Ogi Networks and Data Cymru after ransomware breach via 'Password1' test account exposed 3,300 people
The UK Information Commission's Office (ICO) issued reprimands, not fines, to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales (Data Cymru) after a ransomware attack on 1 November 2024. The intruder used a forgotten test account, Test2, created in January 2012 with the password "Password1", to enter Data Cymru's network. Personal data relating to about 3,300 people, mostly children, was stolen, and 182.7 GB of data was encrypted. The ICO found ONL breached Article 32 of the UK GDPR and said responsibility was shared, because Data Cymru retained overall control of its network. The article does not name the ransomware group.
Technical Details
- Initial access used the valid test account Test2, which had the password "Password1". Bitwarden's tool rates this "very weak", with a cracking time under one second.
- The local administrator accounts on the three affected systems shared the same default password, set in January 2012 and unchanged for more than 12.5 years. Once one system was breached, the local account hashes could be collected and used to authenticate to other systems.
- Before deploying the ransomware, the threat actor exfiltrated 42 GB of data from a primary domain controller, a file server and an SQL server.
- 182.7 GB of data was encrypted on a file server and an internal database server.
- ONL did not review local administrator accounts after deployment and had no auditing procedures for user accounts in Data Cymru's Active Directory.
Remediation
- Routinely identify and remove unused, test and legacy accounts.
- Replace default and shared passwords, and use unique local administrator credentials on each system.
- Review Active Directory and local administrator accounts regularly.
- Define clearly who is responsible for creating and removing accounts between service providers and their customers.
Linha do tempo
-
ICO reprimands Ogi Networks and Data Cymru after ransomware breach via 'Password1' test account exposed 3,300 people
ler a análise desta fonte ocultar
The UK Information Commission's Office (ICO) issued reprimands, not fines, to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales (Data Cymru) after a ransomware attack on 1 November 2024. The intruder used a forgotten test account, Test2, created in January 2012 with the password "Password1", to enter Data Cymru's network. Personal data relating to about 3,300 people, mostly children, was stolen, and 182.7 GB of data was encrypted. The ICO found ONL breached Article 32 of the UK GDPR and said responsibility was shared, because Data Cymru retained overall control of its network. The article does not name the ransomware group.
Technical Details
- Initial access used the valid test account Test2, which had the password "Password1". Bitwarden's tool rates this "very weak", with a cracking time under one second.
- The local administrator accounts on the three affected systems shared the same default password, set in January 2012 and unchanged for more than 12.5 years. Once one system was breached, the local account hashes could be collected and used to authenticate to other systems.
- Before deploying the ransomware, the threat actor exfiltrated 42 GB of data from a primary domain controller, a file server and an SQL server.
- 182.7 GB of data was encrypted on a file server and an internal database server.
- ONL did not review local administrator accounts after deployment and had no auditing procedures for user accounts in Data Cymru's Active Directory.
Remediation
- Routinely identify and remove unused, test and legacy accounts.
- Replace default and shared passwords, and use unique local administrator credentials on each system.
- Review Active Directory and local administrator accounts regularly.
- Define clearly who is responsible for creating and removing accounts between service providers and their customers.