'Password1' and a forgotten test account land Welsh outfits in hot water

Two Welsh organizations, Ogi Networks Limited (ONL) and Data Cymru, have faced regulatory rebukes following a ransomware attack that compromised personal data belonging to approximately 3,300 individuals, primarily children. The Information Commission's Office (ICO) did not impose fines but reprimanded both entities. The attack occurred on November 1, 2024, when a malicious actor exploited a test account named "Test2" to infiltrate Data Cymru's network, encrypt data, and exfiltrate 42 GB of information from a file server and an SQL server.

The test account was created by ONL during its initial project for Data Cymru on January 13, 2012, to test user account access before migrating real users. The password assigned to "Test2" was "Password1," which the ICO rated as "very weak" and estimated could be cracked within less than a second. Both ONL and Data Cymru had not established adequate measures to review or remove inactive accounts, which remained active with the same default password for over 12.5 years.

This oversight allowed the threat actor to breach the network, collect hashed local account credentials, and subsequently access other systems within Data Cymru's network. The ICO emphasized that the password "Password1" posed a significant security risk, serving as an open invitation for malicious actors. ICO head of investigations, David Doodson, stated, "This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands."

The regulator's investigation revealed that neither ONL nor Data Cymru had implemented sufficient procedures to identify and remove outdated accounts, highlighting a failure in their security arrangements. The ICO's reprimands underscored the shared responsibility for these failures, with ONL creating the test account while Data Cymru retained overall network control, including the authority to create or remove accounts.

Both organizations were found guilty of not implementing appropriate technical and organizational measures to safeguard processing systems and services, as per Article 32 of the UK General Data Protection Regulation (GDPR).