2024 Data Cymru / Ogi Networks — ransomware via "Password1" test account; ~3,300 people, mostly children (ICO reprimand)
Data compromised
Personal data of about 3,300 people, most of them children, from two projects supporting children and families; 42 GB taken and 182.7 GB encrypted.
Technical writeup
ICO reprimands announced Oct 20, 2026 for the Nov 1, 2024 ransomware attack on Data Cymru (Local Government Data Unit – Wales). Ogi Networks breached UK GDPR Art. 32(1)(b) and 32(1)(d); Data Cymru breached Art. 28(4), 32(1)(b) and 32(1)(d), including missing sub-processor contract terms. Both accepted the findings; Ogi says it reviewed all accounts and added MFA within a week. No evidence the data was shared or misused. companyConfirmed true.
Root cause
A "Test2" account created in 2012 by IT provider Ogi Networks Limited (sub-processor) was never removed and kept the password "Password1"; the ICO found weak security controls at both organisations.
References
- https://nation.cymru/news/two-welsh-organisations-reprimanded-after-cyber-attack-exposed-childrens-information/
- https://www.theregister.com/cyber-crime/2026/10/20/password1-and-a-forgotten-test-account-land-welsh-outfits-in-hot-water/5304139
- https://herald.wales/national-news/ogi-data-cymru-password1-childrens-data-breach/