Ogi and Data Cymru Reprimanded After Password1 Account Exposed Children’s Data

The UK’s Information Commission’s Office has reprimanded Ogi Networks Limited and Data Cymru after a ransomware attack took personal information relating to 3,300 people, most of them children. The decision was announced on October 20, 2026; the attack itself happened on November 1, 2024.

The distinction matters: this is a new regulatory finding about an older breach, not a report of a fresh attack on Ogi broadband customers. The affected information came from Data Cymru systems and related to two projects supporting children and families.

A test account survived for more than 12 years

The regulator found that a test account called Test2 had existed since January 2012 and used the password Password1. The account had either remained active or been inadvertently reactivated before the attack. The ICO said a third-party strength tool classified the password as very weak.

The attack encrypted 182.7GB of data, while 42GB was taken from Data Cymru’s systems. Those figures describe different effects of the incident and should not be treated as interchangeable.

Security duties fell between two organisations

Ogi Networks created the account, but Data Cymru retained overall control of its network and could instruct Ogi to create or remove accounts. The regulator found that neither had established sufficiently clear, effective checks to identify and remove old accounts.

For Ogi, the findings included inadequate password-strength requirements and a lack of regular audits of accounts it had created. The ICO also found that local administrator accounts on three affected systems retained the same password for more than 12 years.

Data Cymru’s failings included missing legally required data-protection terms in its contract with Ogi and unclear documentation of how Active Directory services would be delivered, monitored and audited. Its account reviews were not routine and did not cover the full environment.

What changed after the breach

The regulator says both organisations strengthened access controls, including multi-factor authentication, and introduced more structured account reviews. They entered into a compliant data-processing contract on April 30, 2025.

For organisations that outsource IT, the practical lesson is specific: a supplier relationship does not remove the need to allocate responsibility for dormant accounts, remote access and privileged credentials. The ICO recommends routine account removal, stronger password controls, multi-factor authentication and clear contractual security duties.

Sources

• ICO: October 20 announcement, findings and remedial action