Weak Credentials and Stale Accounts Enabled Ransomware Breach at Welsh Data Unit
The UK ICO reprimanded Data Cymru and its IT provider for allowing a weak password on a dormant test account to facilitate a major data exfiltration.
Key points
- Attackers used the password 'Password1' on a 12-year-old test account to enter the network.
- The breach resulted in the theft of 42GB of data and encryption of 182.7GB of files.
- The ICO cited failures in password policy, account auditing, and vendor contract terms.
A dormant test account protected by the password ‘Password1’ served as the entry point for ransomware attackers targeting Data Cymru, the Welsh local government data unit. According to Infosecurity Magazine, the UK’s Information Commissioner’s Office (ICO) issued a reprimand in 2024 for this incident, highlighting severe security lapses that exposed sensitive personal information. The compromised account had existed for more than 12 years without being removed or secured, illustrating how legacy infrastructure can create persistent vulnerabilities for modern organizations.
The risk
The threat actors gained initial access through ‘Test 2’, an account that remained active despite being operationally unnecessary. Once inside, they encrypted 182.7GB of data across file servers and an internal SQL database. Before deploying the ransomware, the attackers exfiltrated 42GB of data from a primary domain controller, a file server, and the SQL server. This stolen information included personal details of 3,300 individuals, the majority of whom were children involved in Welsh family support projects.
Who is exposed
Data Cymru, funded by the Welsh government, manages data collection and analysis for local councils. Ogi Networks Limited (ONL) has served as its third-party IT service provider since 2012. The ICO found that both entities failed to maintain appropriate security controls. Specifically, they did not enforce password complexity requirements and neglected to audit accounts regularly. The lack of routine reviews allowed the vulnerable test account to persist for over a decade, creating a long-term exposure vector for external attackers.
Cost and compliance
The ICO determined that both ONL and Data Cymru infringed UK GDPR legislation. Data Cymru was criticized for failing to include legally mandated data protection terms in its contract with ONL, a required step when appointing a sub-processor. Additionally, the organization’s account reviews were irregular and failed to cover the full contents of Active Directory. David Doodson, head of investigations at the ICO, stated that the weak password was a wide-open door, emphasizing that single weak credentials can lead to serious attacks affecting thousands of people.
What to watch
Security leaders should prioritize the identification and removal of dormant or test accounts that may have accumulated excessive privileges over time. Regular audits of Active Directory and other identity management systems are essential to ensure that no unnecessary accounts remain active. Organizations must also verify that third-party IT providers adhere to strict password complexity policies and contractual data protection obligations to prevent similar access breaches.
Signals worth monitoring
Teams usually detect this activity by reviewing authentication logs for successful logins from dormant or rarely used accounts, especially during off-hours. Check whether file access patterns show unusual volume or scope, such as mass reads from domain controllers or SQL servers before encryption begins. Monitor for sudden spikes in outbound data transfers, which often precede ransomware deployment. First containment moves typically involve isolating affected endpoints from the network and resetting credentials for any accounts that may have been compromised or shared with the attacker.
What to do and how to stay safe: Data Cymru
- Conduct an immediate audit of all test, demo, and legacy accounts to ensure they are disabled or deleted if no longer required.
- Enforce strict password complexity requirements and ensure no default or weak passwords exist on any network-accessible accounts.
- Review contracts with third-party IT providers to confirm they include mandatory data protection and security compliance terms.
- Implement regular, scheduled reviews of Active Directory and other identity stores to detect and remove unnecessary permissions or stale accounts.
Step-by-step guide: Security Awareness Training: 6 Misunderstandings That Waste Your Budget
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific account was compromised in this incident?
Attackers compromised a test account named ‘Test 2’ that had existed for more than 12 years and was protected only by the password ‘Password1’.
How much data was stolen and encrypted?
Attackers exfiltrated 42GB of data and encrypted 182.7GB of data held on file servers and an internal SQL server.
What regulatory findings did the ICO make?
The ICO found that both organizations infringed UK GDPR by failing to enforce password strength, conduct regular account audits, and include proper data protection terms in vendor contracts.
