UK Regulator Reprimands Two Firms Over ‘Password1’ Test Account Breach

A test account that IT provider Ogi Networks created in 2012 was still running in November 2024, protected by the password ‘Password1.’ Attackers used it to break into the network of Data Cymru, a Welsh body, and then encrypted data tied to two projects that support children and families in Wales. About 3,300 people were affected, most of them children.

On October 20, 2026, the UK’s Information Commissioner’s Office (ICO) published reprimands for both organizations instead of fines, according to The Register. Coverage ran through October 21 and 22, but the intrusion itself is nearly two years old.

The case is a British enforcement action, and the reporting shows no US victim and no US regulator involvement. Its lesson still applies to any organization that runs service accounts and hands IT work to outside vendors.

The Data Cymru Password1 breach, step by step

The intruder got into Data Cymru’s network through a test account called “Test2,” according to Attack of the Fanboy and The420.in. Ogi Networks created that account in 2012. Nobody audited it or removed it, and it stayed active for more than 12 years.

The attack unfolded in two stages. Before encrypting anything, the attackers stole about 42GB of data from a domain controller, a file server and an SQL server, according to Infosecurity Magazine. They then encrypted about 182.7GB on file servers and an SQL database. That sequence matters because it shows how one weak entry point led to both data theft and operational damage.

A BBC-sourced report carried by Yahoo News dates the breach to November 1, 2024. The data related to two projects supporting children and families in Wales. The affected group covered about 3,300 people, most of them children.

What the ICO found about Ogi Networks and Data Cymru

The ICO found that both organizations breached UK GDPR. The findings below come from press accounts that quote the regulator’s notice, and this story did not review the full notice text.

Ogi Networks Limited, which created the account, was faulted for creating it, failing to remove it and not reviewing local administrator accounts. Data Cymru, formally the Local Government Data Unit – Wales, was faulted for lacking a data protection agreement with Ogi Networks and for not identifying and removing the dormant account, according to The Register and Yahoo News.

The ICO also said the infringements by both organizations went unidentified and unaddressed until its investigation, as described in a write-up of the notice. That detail matters more than the password itself. A weak password only becomes a breach when nobody is checking the account.

David Doodson, the ICO’s head of investigations, put the core lesson in one line: “Password1 is not an appropriate password, it is a wide-open door to nefarious actors.”

Why a forgotten account became the real vulnerability

The attack did not require a zero-day flaw or an exotic technique. It required an account that nobody owned, a weak password and a network that trusted the account. Those gaps often stay hidden because test and service accounts rarely appear on an org chart or in a routine access review.

The second lesson involves responsibility. A vendor built and ran the account, while the customer held the data without a written data protection agreement that set clear security duties for the vendor. Each side could reasonably assume the other was watching. That gap is a recurring weak point in IT outsourcing, and it is not limited to the UK.

US healthcare shows a similar pattern. Becker’s Hospital Review reports that the Aesto Health breach affected 9,540,683 people, a figure reported to HHS. Its disclosure dates to late summer 2026, so it is not new, but it shows the same risk of sensitive data held by a vendor while responsibility is split.

Children’s records are a repeated target. USA 24 has also covered a case in which a hacker copied records of millions of California students from ETS, in a separate California student data breach.

Steps US organizations should take this week

The ICO’s remedy list works as a practical checklist. It calls for strong passwords, multifactor authentication on remote access, regular account reviews and clear responsibility when services are outsourced. Organizations can apply those points with the following steps.

• Inventory every service, test and admin account, including accounts a vendor created on your behalf. Disable any account nobody needs, and record an owner for each one that remains.
• Remove default and shared passwords. Start with accounts named for test or staging environments, because they often sit outside normal monitoring.
• Require multifactor authentication on remote and administrative access. Ransomware crews keep targeting remote entry points, as USA 24 reported in its coverage of Qilin and Inc ransomware exploiting a patched Palo Alto GlobalProtect VPN flaw.
• Review local administrator accounts on a fixed schedule, and remove any that no longer match a current job.
• Put written data protection terms in every IT vendor contract. Name who owns each security duty and who holds which data.

Scale matters too. FBI and CISA have warned that SafePay ransomware has hit more than 600 organizations, which means a weak entry point is attractive to criminals who work in volume.

Parents and guardians can help by asking schools, camps and local programs which vendors hold their children’s data and how long it is kept. It is a simple question. Organizations that cannot answer it quickly have a problem to fix.

What to watch next

The ICO issued reprimands instead of fines, and the sources do not confirm whether the regulator will take further action. The coverage also does not say whether affected families have been notified, or how. Those answers will show whether this reprimand closes the case or opens a wider look at how public bodies manage outsourced IT.

For US readers, the signal to watch is whether regulators or auditors begin citing dormant accounts and vendor split-responsibility as findings in their own reviews. Until then, the practical lesson is straightforward: find the account nobody remembers creating, and fix it before someone else does.