# Weak Password and Forgotten Account Lead to Welsh Data Breach A test account with a simple password compromised 3,300 records in Wales. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-10-20 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/568ad26b-f88a-4fbc-938e-34cf3f7b2731 ## Security Breach Overview A ransomware attack on November 1, 2024, targeted Data Cymru, compromising data for 3,300 individuals, primarily children. The intruder exploited a legacy test account named Test2 to infiltrate the network. This breach resulted in the encryption of 182.7 GB of data and the exfiltration of 42 GB of sensitive information. ## The Password1 Vulnerability The compromised Test2 account utilized the password Password1, which the ICO identified as extremely weak. According to Bitwarden’s strength tool, this password could be cracked in less than one second. This credential served as a wide-open door, allowing unauthorized actors to gain initial access to the internal network infrastructure quite easily. ## Infrastructure and Access Failures Ogi Networks Limited created the test account in January 2012 for initial project testing. The account remained active for over 12.5 years without any security reviews. Furthermore, local administrator accounts across three impacted systems shared the same password, facilitating lateral movement for the attacker once the initial breach occurred successfully. ## Regulatory Reprimands Issued The Information Commissioner's Office issued formal reprimands to both Ogi Networks Limited and Data Cymru rather than imposing financial penalties. The regulator cited violations of Article 32 of the UK GDPR, noting a failure to implement appropriate technical and organizational measures to ensure the security of processing systems and services. ## Lack of Auditing Procedures The investigation revealed that Ogi Networks Limited lacked any auditing procedures to review user accounts within Data Cymru's Active Directory. Because these accounts were never audited or removed after their initial deployment, they remained active and vulnerable for over a decade, creating a significant security blind spot for the involved organizations. ## Shared Responsibility Dynamics The ICO emphasized that responsibility for these failures was shared between the two entities. While Ogi Networks created the test account, Data Cymru retained overall control of its network and the authority to instruct account removals. Neither organization established clear, effective measures to routinely identify and delete obsolete, high-risk user accounts. ## Impact of Legacy Accounts This incident highlights the severe risks associated with maintaining legacy test accounts long after their intended use. The failure to decommission these accounts allowed attackers to bypass modern security protocols. Organizations must prioritize the regular lifecycle management of all administrative credentials to prevent such unauthorized access to sensitive data repositories. ## Lessons for Security Governance Effective security requires continuous monitoring and the enforcement of strict password policies across all network segments. The Welsh breach serves as a critical reminder that even minor oversights, such as failing to remove a single test account, can lead to large-scale data compromises affecting thousands of vulnerable individuals and public institutions. ## Sources covering this story - https://www.theregister.com/cyber-crime/2026/10/20/password1-and-a-forgotten-test-account-land-welsh-outfits-in-hot-water/5304139 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._