“Password1” and a forgotten test account: the ICO’s warning after a Welsh children’s data breach
A test account left in place for more than 12 years, protected by the password “Password1”, opened the door to a ransomware attack that exposed data on 3,300 people, most of them children. The regulator’s reprimand is a checklist every small organisation should read.
By OwnYourStack Admin · Published
On 20 October 2026, the Information Commissioner’s Office (ICO) issued formal reprimands to two Welsh organisations over a ransomware attack in November 2024: the Local Government Data Unit – Wales, known as Data Cymru, and its IT provider since 2012, Ogi Networks Limited.
How the attackers got in
The ICO’s investigation found that the attackers entered Data Cymru’s network through a test account called “Test 2”. It had existed for more than 12 years and its only protection was the password “Password1”.
From there, the attackers copied 42 GB of data from a domain controller, a file server and a SQL database server, then encrypted 182.7 GB of data. The stolen information related to two projects supporting children and families in Wales and included personal data on 3,300 people, the majority of them children.
The ICO’s head of investigations, David Doodson, put it bluntly: “Password1 is not an appropriate password.” He added that a single weak password on an account nobody needed any more had been enough to expose thousands of people.
What each organisation got wrong
Both were found to have infringed the UK GDPR. The ICO criticised the IT provider for not enforcing password strength requirements, for not auditing the accounts it had created on Data Cymru’s network (which is how an unnecessary test account survived for over a decade) and for not reviewing local administrator accounts after they were set up.
Data Cymru, for its part, had no contract with its IT provider containing the data protection terms the law requires when a processor is appointed, and its account reviews were neither scheduled nor routine, and did not cover the whole of its Active Directory.
Why there was no fine
Neither organisation was fined. The ICO took into account the remedial work done since the attack: the IT provider has tightened its access controls, and the two organisations have signed a compliant data processing contract. A reprimand is nonetheless a formal finding of infringement, published for all to see.
Five lessons for small organisations, clubs and charities
The regulator summed up its advice in four points, to which we add a fifth that applies to anyone running their own server:
- Use strong, unique passwords for every account, including service and test accounts. A password manager or a passphrase generator makes this easy.
- Protect remote access with multi-factor authentication. A stolen or guessed password alone should never be enough to get in.
- Review every account regularly, on a schedule, and delete anything that is no longer needed: old staff, test logins, temporary admin accounts.
- Be clear about who is responsible when IT is outsourced, and put it in a written contract with the data protection clauses the UK GDPR requires.
- Apply the same discipline at home. If you run a NAS, a home server or a self-hosted service, list its accounts today. Default and test logins are exactly what automated attacks look for.
None of these controls is expensive or complicated. That is precisely the ICO’s point: basic cyber hygiene is not optional, and its absence can have very real consequences for the people whose data you hold.
