Ogi Networks data breach: UK regulator reprimands two firms over 'Password1'
Representative image: markusspiske / Pixabay
The UK's ICO reprimanded Ogi Networks and Data Cymru on October 20, 2026 after a 'Password1' test account let attackers expose data on 3,300 people, mostly children.
What Happened
The United Kingdom's data protection regulator, the Information Commissioner's Office (ICO), formally reprimanded two Welsh organisations, Ogi Networks Limited and Data Cymru, on Tuesday, October 20, 2026, over a ransomware attack that exposed the personal information of about 3,300 people, most of them children. The ICO said the attacker got in through an old test account called "Test2" that had been protected with the password "Password1" for more than 12 years. Neither was fined; a reprimand is a formal, published finding that the law was broken.
Key Facts
- Regulator: the Information Commissioner's Office, the UK's independent body for data protection.
- Organisations reprimanded: Ogi Networks Limited, an IT provider, and Data Cymru, a company that provides data services to local government in Wales.
- Date of the attack: November 1, 2024. Date of the reprimands: October 20, 2026.
- People affected: about 3,300, most of them children, whose details came from two projects supporting children and families.
- Data involved: according to the ICO's findings as reported, 42GB was taken from Data Cymru's systems and 182.7GB was encrypted.
- Way in: a test account, "Test2", that Ogi told the ICO it created on January 13, 2012, protected by "Password1"; the same password was used for local administrator accounts on three affected systems.
- Legal findings: the ICO said Ogi breached Article 32 of the UK General Data Protection Regulation (UK GDPR), and Data Cymru breached Articles 28(4), 32(1)(b) and 32(1)(d).
- Action since: both organisations have strengthened security, including multi-factor authentication and regular reviews of user accounts, according to the reports of the ICO's findings.
Why It Matters
The case is a plain example of how large breaches often start with small, forgotten things. Ransomware is malicious software that encrypts an organisation's files, often alongside data theft, so attackers can demand payment. Here, the ICO said, no advanced trick was needed. A test account set up in 2012 to check user access was never removed, and its password was easy to guess. The regulator's own password-strength tool rated it as very weak and able to be broken in under a second.
David Doodson, the ICO's head of investigations, put it bluntly: "Password1 is not an appropriate password, it is a wide-open door to nefarious actors." The regulator pointed to failures in removing unused accounts, managing passwords, reviewing access and testing systems. It also found that Ogi had no routine process to audit the accounts it had created inside Data Cymru's Active Directory, the Microsoft service many organisations use to manage logins.
The responsibility was shared. Under data protection law, a "controller" decides why and how personal data is used, and a "processor" handles it on the controller's behalf. Article 28(4) deals with the duties that pass down a chain of service providers, and Article 32 requires security that fits the risk, including the ability to keep systems confidential and to test their safety regularly. The findings show that hiring an outside IT company does not remove an organisation's own duty to keep its data safe. One report of the findings said Data Cymru also had no data protection agreement in place with Ogi.
For India, the lessons are direct. The Digital Personal Data Protection Rules, 2025, which put the Digital Personal Data Protection Act, 2023 into operation, require organisations handling personal data to take reasonable security safeguards, such as access controls and keeping logs, and the Act sets extra protections for children's data. Indian schools, ed-tech start-ups and hospitals that rely on outside IT vendors face the same risk of forgotten accounts and weak passwords.
| Item | What the ICO found |
|---|---|
| Entry point | Test account "Test2", created in 2012, never removed |
| Password | "Password1", also used on three administrator accounts |
| People affected | About 3,300, mostly children |
| Data | 42GB taken, 182.7GB encrypted |
| Outcome | Reprimands for both bodies, no fine |
Impact
Short-term: Ogi Networks and Data Cymru now carry a public finding of breaking UK data law, and other public-sector suppliers have a clear reason to search their own networks for old test and admin accounts.
Long-term: The case adds to pressure on organisations to make multi-factor authentication, which asks for a second proof of identity such as a code on a phone, and regular account reviews standard practice. It also shows regulators will look at both the client and the IT supplier when a breach happens.
Who is affected: The roughly 3,300 people whose data was taken, most of them children, and their families; public bodies in Wales that use Data Cymru's services; IT suppliers to the public sector; and any organisation, in India or elsewhere, that keeps children's data on vendor-managed systems.
Key Takeaway
The UK regulator reprimanded Ogi Networks and Data Cymru on October 20, 2026, after a forgotten 2012 test account protected by "Password1" let attackers expose data on about 3,300 people, mostly children.
Questions and Answers
What happened in the Ogi Networks Limited data breach?
On November 1, 2024, a ransomware attacker used an old test account protected by "Password1" to get into systems used by Data Cymru, exposing information on about 3,300 people, most of them children. The ICO reprimanded Ogi Networks Limited and Data Cymru on October 20, 2026.
Were Ogi Networks and Data Cymru fined?
No. The ICO issued formal reprimands, which are published findings that the law was broken, but it did not impose any financial penalty.
Why did the regulator blame both organisations?
The ICO found that Ogi, which created the account, did not routinely review the accounts it set up in Data Cymru's network, and that Data Cymru did not meet its own security and supplier duties under the UK GDPR.
What can organisations learn from the Password1 case?
Remove test and unused accounts, never reuse simple passwords on administrator accounts, turn on multi-factor authentication, and review regularly who has access, including accounts created by outside IT suppliers.
Disclaimer: Prepared by the Peepals newsroom from publicly available sources with AI assistance. Information is accurate to the best of our knowledge at the time of publication and may change. Images may be representative. Not professional advice. Report an error via our contact page.
Sourced and fact-checked by the Peepals Global Editorial Team
Reported, fact-checked and published by the Peepals Global Editorial Team.
