ICO reprimands Ogi Networks & Data Cymru after 'password1' related credential breach

The Information Commission (ICO) has issued formal reprimands to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, operating as Data Cymru, after a ransomware attack compromised the personal records of 3,300 data subjects, most of whom were children.

The cyberattack, which occurred on 1 November 2024, affected 182.7GB of data in total and resulted in the exfiltration of 42GB of information from systems supporting two projects for children and families. The attackers breached the network via a 12-year-old test account named Test2, which had the password Password1. 

The ICO established that ONL breached Articles 32(1)(b) and 32(1)(d) of the UK General Data Protection Regulation (GDPR) through failures in password complexity, omitting regular network account audits, and leaving administrator credentials unreviewed across three systems for more than a decade. 

The ICO found that Data Cymru infringed UK GDPR Articles 28(4), 32(1)(b), and 32(1)(d) by failing to execute a legally compliant sub-processor contract, neglecting to document service governance for Active Directory, and conducting irregular account reviews that failed to detect dormant profiles.

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.