INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

'Password1' Account Compromised in Ransomware Attack on Children's Data

| 2026-10-21 09:05 CRITICAL LOW RANSOMWARE & EXTORTION DATA BREACH
JSON
Executive Summary
AI-generated
A ransomware attack compromised an account protected by the weak password 'Password1' in Wales, breaching the personal details of thousands of children and their families. The attackers gained initial access via a 12-year-old test account with no security measures, exfiltrating 42GB of data before deploying ransomware that encrypted 182.7GB on file servers and an internal database server. This compromised information related to two projects supporting children and families in Wales, affecting approximately 3300 people, mostly children. The attackers exploited a single weak password, leaving the door open for a serious cyber-attack, as stated by David Doodson, head of investigations at the UK's Information Commissioner's Office (ICO).
Technical Mitigations AI-generated
• Use strong passwords, protect remote access with multi-factor authentication • Regularly review every user account for operational necessity and expiration • Conduct scheduled or routine reviews of local administrator accounts after initial deployment
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
FIVE_EYES FIVE_EYES governmentgovernment
Incident Timeline
‎November 2024
Threat actors used ransomware to target Data Cymru's network, gaining initial access via a compromised test account and subsequently exfiltrating 42GB of data before encrypting an additional 182.7GB on file servers and SQL servers.
organisation Ogi Networks Limited
The data protection regulator issued a reprimand to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, for security failings relating to the November 2024 incident.
attribution the Local Government Data Unit – Wales
The data protection regulator issued a reprimand to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, for security failings relating to the November 2024 incident.
organisation Data Cymru
The data protection regulator issued a reprimand to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, for security failings relating to the November 2024 incident.
data_breach 42 GB
Before deploying the ransomware, the attackers exfiltrated 42GB of data from a primary domain controller, a file server and an SQL server.
organisation ONL
ONL has acted as Data Cymru's third-party IT service provider since 2012.
organisation Data Cymru's
ONL has acted as Data Cymru's third-party IT service provider since 2012.
organisation Data Cymru’s
How the Attack Unfolded Attackers gained initial access to Data Cymru’s network via a compromised test account known as ‘Test 2’, which had existed for more than 12 years.
organisation SQL
Access to this account enabled the threat actor to infiltrate Data Cymru’s network and encrypt 182.7GB of data held on a file servers and an internal database (SQL) server.
data_breach 182.7 GB
Access to this account enabled the threat actor to infiltrate Data Cymru’s network and encrypt 182.7GB of data held on a file servers and an internal database (SQL) server.
organisation ICO
David Doodson, head of investigations at the ICO, criticized both organizations, stating: “Password1 is not an appropriate password, it is a wide-open door to nefarious actors.
organisation Doodson
Doodson said, “The lesson for every organization is straightforward: use strong passwords, protect remote access with multi-factor authentication, regularly review every user account, and be completely clear about who is responsible for cyber security when services are outsourced.
‎October 20
The ICO stated that infringements by two organizations continued without being identified or addressed.
‎2026/10/21
Ransomware attackers compromised an account protected by the weak password 'Password1' to breach thousands of children's personal details in Wales.
organisation Children’s Data
Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ Account.
organisation Ransomware Attack Compromises
Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ Account.
organisation Active Directory
…y requirements to an account Not conducting regular audits of accounts it had created within Data Cymru’s network, allowing the operationally unnecessary test account to remain in existence for more than 12 years Not reviewing local administrator accounts after their initial deployment Data Cymru was criticized for failings such as not having a contract in place with ONL containi…
Tactical Metrics
Metrics
data_breach
42
Gb
Before deploying the ransomware, the attackers exfiltrated 42GB of data from a primary domain controller, a file server and an SQL server.
Metrics
data_breach
183
Gb
Access to this account enabled the threat actor to infiltrate Data Cymru’s network and encrypt 182.7GB of data held on a file servers and an internal database (SQL) server.
Intelligence Sources
Infosecurity-Magazine 2026-10-21