UK regulators say a ransomware attack on Data Cymru in November 2024 exposed personal data for 3,300 people, most of them children, after attackers used a forgotten test account with the password "Password1" to get in. The ICO said Ogi Networks had created the Test2 account in 2012 and that shared local administrator passwords across impacted systems helped the intruder move from one server to others; 42 GB was exfiltrated before 182.7 GB was encrypted.
Why it matters: This matters because it shows how a single weak, forgotten account and reused admin passwords can turn a small oversight into a breach affecting thousands. Organizations using managed IT providers should review dormant accounts, rotate local admin credentials, and audit shared responsibility for account lifecycle controls.
2026.10.20
100% relevant
This article establishes the story by providing the first concrete, regulator-backed account of the underlying breach, including the attack date, exposed data volume, weak test account, password reuse, and resulting ICO reprimands.
← Back to all stories