Test account using “Password1” caused data leak affecting thousands of people
The majority of the victims were children.
Woman breathing in and out a password. Image by Cybernews.
Follow us
- The ICO reprimanded Ogi Networks and Data Cymru after a cyberattack exposed 3,300 people.
- Most victims were children, and attackers encrypted 182.7GB of data.
- A test account used the weak password “Password1” and stayed active or was reactivated for over 12 years.
- The ICO urges organizations to remove unused accounts, block weak passwords, and use multi-factor authentication.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
The Information Commissioner’s Office (ICO) has reprimanded 2 Welsh organizations for exposing sensitive information of 3,300 people after a cyberattack, the majority of whom were children.
According to the UK’s privacy and data protection authority, Ogi Networks Limited (ONL) created a test account called “Test2” in January 2012, which was protected by the password “Password1.”
The test account was created within the Local Government Data Unit Wales, also known as Data Cymru.
Check if your data was exposed
Find out if your email and related personal information have appeared in known data breaches.
As you might guess, a third-party password strength tool classified this password as “very weak.”
For more than 12 years, the test account either remained active or was inadvertently reactivated just before the cyberattack, which took place on November 1st, 2024. All this time, ONL failed to conduct regular security audits.
In addition, ONL didn’t review local administrator accounts after their initial deployment, with accounts on 3 affected systems retaining the same password for more than 12 years.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Because of this, attackers managed to encrypt 182.7GB of data, with 42GB taken from Data Cymru, exposing sensitive information of 3,300 people in the process.
Data Cymru isn’t off the hook. The organization didn’t have a contract with ONL detailing legally mandated data protection terms. It also neglected to document how ONL’s Active Directory services would be delivered, monitored, or audited. Lastly, it failed to ensure that the Test2 account was identified and removed or had its password updated.
“Password1 is not an appropriate password – it is a wide-open door to nefarious actors. This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyberattack that can affect thousands,” David Doodson, Head of Investigations at the Information Commission’s Office, said in a statement.
A spokesperson for ONL said that within a week of the cyberattack, every account was checked and deactivated if it was no longer needed.
“We also brought in independent cybersecurity specialists to investigate. Since then, we've protected remote access with multi-factor authentication and introduced regular account reviews for the customers whose networks we look after, so accounts that aren't needed are found and removed,” the spokesperson told the BBC.
The ICO recommends that businesses and organizations remove accounts that are no longer required, implement multi-factor authentication (MFA) to protect remote access, block weak passwords, regularly audit their corporate digital environment, avoid shared administrative credentials, and define responsibilities with IT providers in contracts.
