Most ransomware stories involve a zero-day, a phishing campaign or a cleverly abused remote-access tool. This one involves an account called Test2 and the password Password1.
On 20 October 2026 the UK Information Commissioner's Office (ICO) issued reprimands to two Welsh organisations, Ogi Networks Ltd (ONL) and Data Cymru, formally the Local Government Data Unit - Wales, over a ransomware attack on 1 November 2024. According to the ICO, the attackers took personal information about 3,300 people, the majority of them children. The attack exploited a test account that had existed for more than 12 years, protected by a password that a third-party strength tool classed as very weak.
"Password1 is not an appropriate password, it is a wide-open door to nefarious actors," said David Doodson, the ICO's Head of Investigations.
Who the two organisations are
Data Cymru is funded by the Welsh government, and ONL has been its third-party IT provider since 2012, Infosecurity Magazine reported. That outsourced arrangement matters to how the ICO split the blame. The regulator said responsibility was shared: ONL created the account, but Data Cymru kept overall control of its own network, including the ability to instruct ONL to create or remove accounts.
Both organisations were found to have infringed UK GDPR, the UK's version of the EU data protection law. Neither was fined. A reprimand is a formal public finding that an organisation broke the law, with no monetary penalty attached.
A test account nobody cleaned up
According to The Register, ONL said it created the Test2 account on 13 January 2012 with the password Password1, likely to test user account access before migrating real users. The ICO said the account had either stayed active since creation or been inadvertently reactivated before the incident. To show how weak the password was, the ICO pointed to Bitwarden's password strength tool, which rated it very weak and estimated it could be cracked in under a second.
Test accounts are a familiar problem. Someone creates one to try out a configuration or a deployment, gives it a placeholder password, and moves on. The account never gets an owner, never gets reviewed, and stays on the network for years. The ICO's findings against ONL describe exactly that: no appropriate password strength or complexity requirements on the account, and no regular audits of the accounts it had created within Data Cymru's network. The Register reported that ONL had no auditing procedures to review user accounts in Data Cymru's Active Directory. Active Directory is the Microsoft directory service most Windows networks use to manage users, computers and permissions.
From one weak account to the domain controller
A weak password on one account does not have to lead to a network-wide breach. Here a second failure helped turn it into one.
The Register reported that the local administrator accounts on the three impacted systems all had the same password, and had kept the default passwords set in January 2012 for more than 12.5 years. Other coverage identifies the systems the attackers took data from as a primary domain controller, a file server and an SQL server. Local administrator accounts are built-in accounts with full control over a single machine. When several machines share one local admin password, a single stolen credential, or the cryptographic hash Windows stores in place of the password, can work on all of them. The ICO said that once one system had been breached, the local account hashes could be collected and used by the threat actor to authenticate to other systems on the Data Cymru network.
The domain controller is the server that runs Active Directory and decides who can log in to what. Reaching it is usually the end of the game for a defender. According to the ICO, the threat actor exfiltrated 42 GB of data before deploying the ransomware, and 182.7 GB was encrypted in total.
That order of events, steal first and then encrypt, is the standard double-extortion model: even if the victim restores from backup, the attackers still hold a copy of the data. The ICO said the compromised information related to two projects supporting children and families.
None of the sources name the ransomware group behind the attack, and the ICO's announcement does not attribute it.
Why a reprimand and not a fine
The sources confirm only that both organisations received reprimands and no financial penalty. The ICO said ONL infringed Article 32 of UK GDPR, which requires appropriate technical and organisational measures to keep processing systems secure and to test whether they work. Data Cymru was also found to have infringed Article 28(4), because it had no contract with ONL containing the legally mandated data protection terms. Identical admin passwords across core servers and a decade-old test account with a very weak password are hard to defend as appropriate when the data concerns children.
The ICO's choice to name ONL alongside Data Cymru is the part worth noting for anyone in an outsourced IT relationship. The customer was not the only one held to account. The provider that created the account and ran the Active Directory services was reprimanded as well.
What It Means for Defenders
No patch fixes this, because no software vulnerability is described in the sources. Every failure the ICO identified is a basic hygiene control, which is why the case is worth taking to your next change meeting. The regulator's stated lessons are strong passwords, multi-factor authentication (MFA) on remote access, regular account reviews and clarity about who is responsible for security when services are outsourced. Based on the failings set out in the sources, here is what to check:
- Find stale and orphaned accounts. Review Active Directory for accounts with names like test, temp, demo or old project names, accounts with no named owner, and accounts that have not signed in for a long time. Disable first, then delete once you are sure nothing depends on them. The ICO's criticism of ONL specifically mentions the lack of regular account audits.
- Enforce password strength everywhere, including service and test accounts. The Test2 account had no appropriate strength or complexity requirements applied. Make sure your password policy covers every account type, and block common and well-known passwords such as Password1.
- Give every machine a unique local administrator password. The ICO said the shared local admin password across the three affected systems meant a breach of one allowed hashes to be used against the others. Unique, regularly reviewed local admin passwords per machine stop one stolen hash from unlocking the rest.
- Require MFA on remote access. This is one of the ICO's headline recommendations. A guessed or cracked password alone should not be enough to get into your network from outside.
- Protect your domain controllers. Treat them as your most sensitive systems: limit who can sign in, and watch for unusual logins and large outbound data transfers. The 42 GB taken here was exfiltrated before the ransomware was deployed.
- Put security duties in your IT provider contract. If a managed service provider runs your infrastructure, agree in writing who owns account reviews, password policy and admin credential management. The ICO held both the provider and the client responsible here, so "the MSP handles it" will not protect either side.
For federal contractors working through CMMC, none of this is new. Account management, authenticator strength and MFA for remote access are all core controls. The Welsh case shows what happens when they are not applied in practice. The most dangerous account on a network is often not the one that gets the most attention but the one nobody remembers creating.
