What Happened
In November 2024, ransomware attackers breached Data Cymru's network through a test account with the password 'Password1'. This account, created by third-party IT provider Ogi Networks Limited (ONL), had been unused for over 12 years. Attackers encrypted 182.7GB of data and exfiltrated 42GB containing personal information for 3,300 people, mostly children and families in Welsh government-funded support programs.
The UK Information Commissioner's Office reprimanded both organizations on October 20, 2024, but issued no financial penalty.
Timeline
2012 or earlier: ONL creates 'Test 2' account with 'Password1' during initial IT service deployment for Data Cymru.
12+ years: Account remains active and unaudited. No password updates, no access reviews, no deprovisioning.
November 2024: Attackers discover and compromise the test account, gain network access, and move laterally to domain controllers and SQL servers.
Attack progression: Threat actors exfiltrate 42GB from primary domain controller, file server, and SQL server before deploying ransomware that encrypts 182.7GB.
Post-breach: Data Cymru discovers the compromise. ICO investigation begins.
October 20, 2024: ICO publishes reprimands for both organizations.
Which Controls Failed or Were Missing
Access provisioning and deprovisioning: ONL created the test account but never removed it when testing concluded. The account sat dormant for more than a decade with full network access.
Password policy enforcement: No complexity requirements prevented 'Password1' from protecting an account with network privileges. No periodic password rotation forced an update in 12 years.
Account auditing: ONL conducted no regular reviews of accounts it created within Data Cymru's infrastructure. Operationally unnecessary accounts weren't identified or removed.
Multi-factor authentication: The account relied solely on password authentication. No second factor protected remote or privileged access.
Active Directory governance: Data Cymru's account reviews weren't scheduled, weren't routine, and didn't cover the full Active Directory structure. Local administrator accounts went unreviewed after initial deployment.
Processor contract terms: Data Cymru had no contract with ONL containing the data protection terms required under Article 28 UK General Data Protection Regulation when appointing a processor. Responsibilities for security controls remained undefined.
Least privilege: The test account apparently retained broad network access rather than being scoped to specific test environments or systems.
What UK General Data Protection Regulation Requires
Article 32 (Security of Processing) mandates that controllers and processors implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. This includes pseudonymisation, encryption, ongoing confidentiality, and the ability to restore availability after an incident.
For authentication specifically, this means:
- Strong password policies with complexity and length requirements
- Regular password rotation for privileged accounts
- Multi-factor authentication for remote access and administrative functions
- Periodic access reviews to identify and remove unnecessary accounts
Article 28 (Processor) requires controllers to use only processors that provide sufficient guarantees to implement appropriate Technical and Organisational Measures. Paragraph 3 mandates that processing by a processor be governed by a contract that sets out the subject matter, duration, nature, purpose, and obligations of both parties.
The contract must specify that the processor will implement appropriate security measures under Article 32. Without this contract, Data Cymru had no documented mechanism to hold ONL accountable for the security controls it was supposed to maintain.
Article 5(1)(f) (Integrity and Confidentiality) requires that personal data be processed in a manner that ensures appropriate security, including protection against unauthorized processing and accidental loss. A 12-year-old account with 'Password1' protecting children's data fails this principle entirely.
Lessons and Action Items for Your Team
Audit every account in your directory right now. Don't limit reviews to user accounts. Service accounts, test accounts, contractor accounts, and local administrator accounts all create risk. If you can't identify who needs an account and why, deprovision it. The ICO's David Doodson stated it clearly: "A single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack."
Enforce password complexity at the technical level. Don't rely on policy documents. Configure Active Directory or your identity provider to reject passwords that don't meet NIST SP 800-63B guidance: minimum 8 characters (12+ for privileged accounts), complexity requirements, and rejection of commonly used passwords. 'Password1' should be technically impossible to set.
Implement multi-factor authentication for all remote access and privileged accounts. The test account compromise wouldn't have led to network access if a second factor was required. Prioritize MFA for VPN, administrative consoles, and any account with elevated privileges.
Schedule recurring access reviews. Manual, ad-hoc reviews miss accounts. Configure quarterly reviews in your identity governance system that force account owners to certify continued need. Accounts without an active owner get automatically disabled.
Define security responsibilities in processor contracts before processing begins. Article 28 UK General Data Protection Regulation isn't optional. Your contract with every processor must specify which party implements password policies, conducts account audits, manages MFA, and monitors for unauthorized access. If your processor created the accounts, your contract must require them to audit those accounts.
Scope test and development accounts to isolated environments. Test accounts shouldn't have production network access. Use separate Active Directory domains or cloud tenants for non-production work. If test data requires production system access, use anonymized or synthetic data sets.
Review local administrator accounts after initial deployment. ONL's failure here is common: accounts get created during system setup and never revisited. Add local admin review to your quarterly access certification process. If the account isn't actively used, remove it.
Document who is responsible for what when you outsource IT. The ICO noted that Data Cymru lacked clarity about cyber security responsibilities. Your contract should specify: Who creates accounts? Who audits them? Who enforces password policies? Who implements MFA? Who monitors for compromised credentials? Ambiguity creates gaps.
The absence of a financial penalty doesn't diminish the severity. Three thousand children had their personal data exfiltrated because basic controls weren't implemented. Your organization's test accounts and processor contracts deserve review this week, not after the next breach.
