The ICO announced reprimands against Ogi Networks Limited and Data Cymru on 20 October 2026 after a ransomware attack exposed personal information about 3,300 people, most of them children. The ICO announcement identifies a test account protected by “Password1” as the route into the network.
The attack happened on 1 November 2024. The October announcement concerns the regulatory response to that earlier incident.
A test account created in 2012
Ogi Networks, which supplied managed IT services, created the “Test2” account in January 2012. It was intended for testing before real users were moved onto the service. The account either remained active or was inadvertently reactivated before the attack; the ICO did not establish which. Its original weak password was still in use.
The Ogi reprimand records that initial network access appeared to have used a VPN connection under Test2. The account had basic user access rather than administrative privileges. Investigators considered password spraying the likely method of compromise: trying a common password against multiple accounts.
The attacker encrypted 182.7GB of data and took 42GB from Data Cymru’s systems. The affected information concerned two projects supporting children and families.
The ICO found failures on both sides of the service arrangement
Ogi was reprimanded for infringements of UK GDPR Articles 32(1)(b) and 32(1)(d), covering security and the regular assessment of security measures. The findings included inadequate password controls and the absence of regular reviews of accounts it had created within Data Cymru’s network. Local administrator accounts on three affected systems also retained the same password for more than 12 years.
Data Cymru retained overall control of its network. Ogi could create or remove accounts only on its instructions. That division of authority did not produce a clear, effective process for finding and removing unnecessary accounts.
The Data Cymru reprimand found infringements of Articles 28(4), 32(1)(b) and 32(1)(d). Data Cymru acted as a processor for its customers, with Ogi acting as its sub-processor. Their existing order form lacked the required data protection terms. It also failed to explain how the Active Directory service would be delivered, monitored and audited.
Data Cymru had strengthened its password policy, but Test2 had not been brought into line with it. Its account reviews were neither scheduled nor routine and covered a limited group instead of the full Active Directory environment. A stronger written policy had left an older account untouched.
Reprimands and subsequent changes
The published outcome was a reprimand for each organisation, rather than a financial penalty. Both introduced account-management improvements and stronger access controls, including multi-factor authentication. They entered into a compliant data processing contract on 30 April 2025.
Data Cymru’s functions transferred to the Welsh Local Government Association on 1 April 2026, a later organisational change noted in the decisions.
What managers can check with their IT provider
The ICO recommendations focus on removing unnecessary accounts, blocking weak passwords, protecting remote access and defining supplier responsibilities.
Measured Collective’s editorial advice is to ask the IT provider who identifies unnecessary accounts and who authorises their removal, addressing the division of responsibility described in this case.
For related coverage of supplier security and remote access, see the Advanced ransomware case.
