THOUSANDS of children and their families were affected when ransomware attackers breached Data Cymru, the Local Government Data Unit – Wales, via a long-standing test account that was protected by the password “Password1”. The ICO’s investigation found that the initial access came through this test account, which had existed for more than 12 years and was the sole barrier on entry to the network.
The attackers exfiltrated 42GB of data from a primary domain controller, a file server and an SQL server before deploying ransomware that encrypted 182.7GB of data on file servers and an internal SQL database. The compromised data related to two Welsh projects supporting children and families, impacting around 3,300 individuals, the majority of whom were children.
The ICO criticised both organisations for security failings: ONL did not enforce password strength, failed to audit long-standing test accounts, and did not routinely review local administrator accounts; Data Cymru did not have a contract with ONL containing required data protection terms for sub-processors and did not conduct routine, comprehensive reviews of Active Directory. The regulator issued a reprimand on 20 October, but did not impose a financial penalty on either party.
Remedial steps reportedly included ONL strengthening account access controls and establishing a compliant data processing agreement between ONL and Data Cymru. David Doodson, head of investigations at the ICO, emphasised that Password1 is an inadequate password and warned that weak credentials and unused accounts can leave organisations exposed to serious cyber-attacks.