The Information Commission’s Office (ICO) identified serious security failures at Ogi Networks Limited, an IT service provider, and the Local Government Data Unit – Wales, known as Data Cymru, following its investigation into the November 2024 cyberattack.
The regulator announced its findings on October 20, revealing that attackers had exploited an obsolete test account called “Test2”, created in January 2012. The account had either remained active throughout its existence or been inadvertently reactivated before the breach.
Investigators discovered that its original password had never been strengthened. A third-party password assessment tool classified “Password1” as very weak, estimating that it could be compromised in less than one second.
The attack on November 1, 2024, resulted in criminals extracting 42 gigabytes of information from Data Cymru’s systems and encrypting another 182.7 gigabytes. The stolen material concerned two projects supporting children and families across Wales.
David Doodson, the ICO’s head of investigations, said: “Password1 is not an appropriate password, it is a wide-open door to nefarious actors.”
He said the incident demonstrated how an unnecessary account protected by inadequate credentials could expose thousands of individuals to a serious cyberattack.
The investigation established that Ogi Networks had created the test account while providing technical services to Data Cymru. However, Data Cymru retained overall control of its network and could instruct its contractor to create, modify or remove accounts.
Neither organisation had established sufficiently effective procedures for identifying and deleting accounts that were no longer required.
The regulator found that Ogi Networks had breached Article 32 of the UK General Data Protection Regulation by failing to maintain appropriate security safeguards and regularly evaluate their effectiveness.
Its investigation identified additional weaknesses involving administrator accounts on three affected systems. These accounts had retained identical passwords for more than 12 years, increasing the opportunity for attackers to move between compromised machines.
Ogi Networks had not reviewed those administrator accounts following their initial deployment, allowing outdated credentials to remain operational without adequate scrutiny.
Data Cymru was separately found to have breached provisions of the UK GDPR governing security and contractual responsibilities for outsourced data processing.
The organisation had failed to establish a contract containing mandatory data protection provisions for its arrangements with Ogi Networks. Responsibilities for monitoring and auditing directory services were also insufficiently documented.
Its account reviews were neither systematic nor comprehensive, and the obsolete test account escaped detection despite subsequent improvements to password requirements.
The ICO issued formal reprimands rather than financial penalties against the organisations.
Ogi Networks accepted the findings, acknowledging that the test account should have been removed long before criminals exploited it.
The company said it had worked with Data Cymru within a week of the attack to examine existing accounts and disable those no longer required. Independent cybersecurity specialists were also appointed to investigate the incident.
Ogi Networks subsequently introduced stronger remote-access protections, including multifactor authentication, and procedures encouraging customers to review accounts periodically.
The company said the breach was confined to infrastructure hosted for Data Cymru and that information belonging to its other customers had not been affected.
A spokesperson for the Welsh Local Government Association said Data Cymru had merged with the association in 2025, transferring its staff and functions.
The association accepted the regulator’s reprimand and said there was no evidence that the compromised information had been distributed further or misused.
It also confirmed improvements to account management, password controls, remote access and contractual oversight following the attack.
The regulator also highlighted the risks created when organisations outsource technical operations without clearly allocating responsibility for security checks. Doodson emphasised that both service providers and their customers must maintain effective oversight of access controls.
Investigators found that the organisations had allowed their respective security shortcomings to persist without identifying or addressing them. The failures extended beyond the compromised test account to broader weaknesses in administrative access and monitoring arrangements.
On April 30, 2025, Data Cymru and Ogi Networks signed a revised data processing agreement containing the legally required provisions. Data Cymru also introduced periodic account reviews, while Ogi Networks established a process for advising customers about accounts that should be removed from their networks.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
