'Password1' test account led to Welsh ransomware breach of 3,300
Original title: 'Password1' and a forgotten test account land Welsh outfits in hot water
The ICO reprimanded, but did not fine, Ogi Networks and Data Cymru after 42 GB was stolen and 182.7 GB encrypted.
The UK Information Commissioner's Office reprimanded Ogi Networks Limited and Data Cymru after a November 1, 2024 ransomware attack. An intruder used a Test2 account created on January 13, 2012 with the password Password1, then reused a shared local-administrator password to reach other systems. Before encryption, 42 GB was taken from a domain controller, a file server and an SQL server; 182.7 GB on a file server and internal database server was encrypted. Exposed records covered 3,300 people, mostly children. The ICO cited Article 32 UK GDPR failures and issued reprimands rather than fines.
Unconfirmed: The ransomware family and the intruder are not named.
- The Test2 password Password1 had been unchanged for more than 12.5 years.
- Local administrator accounts on the three impacted systems shared one password.
- ONL had no auditing process to review Data Cymru Active Directory accounts.
- Data Cymru kept overall control of the network, including account create and remove instructions.
- The ICO published separate reprimands of ONL and Data Cymru.
Impact: Personal data of 3,300 people stolen and systems encrypted
- 1.Remove unused test and local administrator accounts and stop reusing default passwords.
- Vendors
- Ogi Networks
- Victims
- Data Cymru
- Organizations
- Information Commissioner's Office
- Countries
- United Kingdom
From the original article
2 min read at theregister.comICO reprimands Ogi Networks and Data Cymru after ransomware breach exposes info of 3,300 people, mostly children
By Paul Kunert · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.