INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Welsh outfits caught using forgotten test account for password breach

| 2026-10-20 13:35 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
A ransomware attack on Data Cymru, a Welsh organization providing server and connectivity infrastructure to public bodies across Wales, exposed personal data of 3,300 people, mostly children. The incident occurred in November 2024 after an intruder exploited a forgotten test account called "Test2" protected by the weak password "Password1", which was created on January 13, 2012. The Information Commission's Office (ICO) issued reprimands to Ogi Networks Limited and Data Cymru for failing to implement adequate security measures, including regular assessments of user accounts. The attack worked by exploiting a single weak password that remained active despite being no longer needed, allowing the intruder to authenticate access to other systems on the network. As of now, the current status is unclear as there are no further details provided about the incident's aftermath or any subsequent actions taken by Ogi Networks Limited and Data Cymru.
Technical Mitigations AI-generated
• Regularly review and evaluate user accounts within Active Directory to identify inactive or unused accounts. • Implement auditing procedures to detect weak passwords, such as using Bitwarden's password strength tool to rate the strength of "Password1". • Use a strong password manager like Bitwarden to generate unique, complex passwords for all accounts, including test accounts.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
FIVE_EYES FIVE_EYES governmentgovernment
Incident Timeline
‎January 13, 2012
The ICO cited Bitwarden's password strength tool as the reason for its investigation into a forgotten test account created in 2012, which was rated "very weak" and estimated to be crackable in under a second.
industry Government
General Document Context
organisation Bitwarden
" The ICO cited Bitwarden's password strength tool, which rated "Password1" as "very weak" and estimated a cracking time of less than a second.
‎January 2012
Threat actors exploited the lack of auditing procedures at ONL to maintain unused test accounts with default passwords in Data Cymru's Active Directory for over 12.5 years.
organisation Data Cymru's Active Directory
It found ONL had no auditing procedures to review user accounts within Data Cymru's Active Directory.
‎November 1, 2024
Threat actors exploited a test account to infiltrate Data Cymru's network and encrypt 182.7 GB of data before deploying ransomware, exfiltrating an additional 42 GB from primary domain controllers and servers.
industry Government
General Document Context
tactic Ransomware
On November 1, 2024, Data Cymru suffered a ransomware attack after a miscreant exploited a test account called Test2 to infiltrate its network and encrypt 182.7 GB of data housed in a file server and an internal database server.
data_breach 182.7 GB
On November 1, 2024, Data Cymru suffered a ransomware attack after a miscreant exploited a test account called Test2 to infiltrate its network and encrypt 182.7 GB of data housed in a file server and an internal database server.
organisation SQL
"Before deploying the ransomware, the threat actor exfiltrated 42 GB of data from a primary domain controller, a file server and an SQL server," the ICO said on Tuesday in its reprimand of ONL  [PDF].
organisation ONL
"Before deploying the ransomware, the threat actor exfiltrated 42 GB of data from a primary domain controller, a file server and an SQL server," the ICO said on Tuesday in its reprimand of ONL  [PDF].
organisation PDF
"Before deploying the ransomware, the threat actor exfiltrated 42 GB of data from a primary domain controller, a file server and an SQL server," the ICO said on Tuesday in its reprimand of ONL  [PDF].
data_breach 42 GB
"Before deploying the ransomware, the threat actor exfiltrated 42 GB of data from a primary domain controller, a file server and an SQL server," the ICO said on Tuesday in its reprimand of ONL  [PDF].
‎2026/10/20
The Information Commission's Office reprimanded Ogi Networks Limited and Data Cymru for a ransomware breach that exposed personal data of 3,300 people, mostly children.
organisation ICO
cyber-crime 'Password1' and a forgotten test account land Welsh outfits in hot water ICO reprimands Ogi Networks and Data Cymru after ransomware breach exposes info of 3,300 people, mostly children A test account protected by "Password1" helped an intruder steal personal data relating to 3,300 people, mostly children, in a ransomware attack that h…
organisation Ogi Networks
cyber-crime 'Password1' and a forgotten test account land Welsh outfits in hot water ICO reprimands Ogi Networks and Data Cymru after ransomware breach exposes info of 3,300 people, mostly children A test account protected by "Password1" helped an intruder steal personal data relating to 3,300 people, mostly children, in a ransomware attack that h…
organisation The Information Commission's
The Information Commission's Office (ICO) issued reprimands rather than fines to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, also known as Data Cymru.
organisation Ogi Networks Limited
The Information Commission's Office (ICO) issued reprimands rather than fines to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, also known as Data Cymru.
organisation Data Cymru
The Information Commission's Office (ICO) issued reprimands rather than fines to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, also known as Data Cymru.
Tactical Metrics
Metrics
data_breach
183
Gb
On November 1, 2024, Data Cymru suffered a ransomware attack after a miscreant exploited a test account called Test2 to infiltrate its network and encrypt 182.7 GB of data housed in a file server and an internal database server.
Metrics
data_breach
42
Gb
"Before deploying the ransomware, the threat actor exfiltrated 42 GB of data from a primary domain controller, a file server and an SQL server," the ICO said on Tuesday in its reprimand of ONL  [PDF].
Intelligence Sources
The Register - Cybercrime 2026-10-20