TWO Welsh organisations have been censured by the UK Information Commissioner’s Office (ICO) after a ransomware incident led to the theft of personal data belonging to about 3,300 individuals, the vast majority of whom were children. The organisations affected were Ogi Networks Limited (ONL) and Data Cymru (the Local Government Data Unit – Wales). The ICO reprimands accompany findings that underline weaknesses in access management and governance that contributed to the breach.
Evidence from the ICO notes that the attack exploited a long‑standing test account named ‘Test2’, which had existed for more than 12 years and had either remained active since creation or been reactivated shortly before the breach. The breach occurred on 1 November 2024 and involved unauthorised access to personal data.
The practical response reflected in the ICO actions centres on accountability and the need for organisations to implement stronger account lifecycle controls and monitoring for privileged or test accounts. The article highlights the reprimands as the formal regulatory outcome, with the ICO emphasising lessons learned and the necessity for remediation to prevent recurrence.