On 20 October 2026 the Information Commissioner’s Office reprimanded Ogi Networks and Data Cymru after a test account created in 2012, protected by the password “Password1”, let an attacker into Data Cymru’s network and deploy ransomware. Data on about 3,300 people, mostly children, was taken. The lesson for a small business is not about the password. It is about the account nobody remembered.
This is a cyber security story with no exotic technique in it. No zero-day, no AI, no nation state. Just an account that should have been deleted twelve years earlier, and two organisations each assuming the other was looking after it.
What happened in the Data Cymru ransomware attack?
An attacker used a dormant test account to get in, then spread across the network using shared administrator passwords before encrypting the data. The ICO’s reprimands, published on 20 October 2026, set out the sequence.
Ogi Networks supplied Data Cymru’s servers, connectivity, licensing and support. In January 2012, during the original project, it created an account called Test2 to check user access before real users were migrated. The password was Password1. The account was never removed (ICO reprimand of Ogi Networks, 20 October 2026).
On 1 November 2024 the attacker signed in with it. The local administrator accounts on three systems all shared the same password set in 2012, so once one system was breached the others followed. The attacker took 42 GB of data from a domain controller, a file server and an SQL server, then encrypted 182.7 GB (The Register, 20 October 2026, citing the ICO). Nobody had reviewed those accounts in more than twelve and a half years.
David Doodson, the ICO’s head of investigations, put it plainly: “Password1 is not an appropriate password, it is a wide-open door to nefarious actors.” He added that “a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands” (ICO, 20 October 2026).
Why did both organisations get reprimanded?
Because the ICO found that responsibility did not sit with one of them alone. The supplier created the account and never audited it. The customer owned the network and never asked.
Ogi Networks was reprimanded under Article 32 of UK GDPR for failing to put appropriate technical and organisational measures in place, and for having no procedure to review user accounts in Data Cymru’s directory. Data Cymru was reprimanded for the same article and for its contract with Ogi, which lacked the terms UK GDPR requires between a controller and a processor. Its own account reviews were described as irregular and incomplete (ICO, 20 October 2026).
That split is the part most small businesses should sit with. Outsourcing your IT does not outsource your accountability for it. If your IT supplier set something up years ago and nobody has looked since, the regulator’s view is that you should have asked.
What does the ICO Password1 reprimand mean for your business?
Every business that has used an IT supplier for more than a couple of years has a Test2 somewhere. The question is whether anyone can list them. Here is what the case asks you to check.
- Every account in your Microsoft 365 tenant and on every server, with a named owner and a reason to exist. Anything without both gets disabled now and deleted after 30 days.
- Accounts created by suppliers, past and present. Installers, migration tools, monitoring agents and “temporary” admin logins are the usual suspects. Ask each supplier for their list and compare it with yours.
- Local administrator passwords. If the same one is used on more than one machine, one breach becomes every breach. Windows LAPS gives each device its own, rotated automatically.
- Multi-factor authentication on every account that can sign in remotely, including service and admin accounts. Password1 behind MFA is still a bad password, but it is no longer a door.
- A written review date. Cyber Essentials requires you to remove or disable accounts that are no longer needed, and an assessor will ask how you know. Quarterly is a reasonable answer. “When we remember” is not.
- The contract with your IT supplier. It should say who creates accounts, who reviews them, how often, and who signs off. The ICO reprimanded Data Cymru partly because its contract did not.
If the list is long, start with anything that can sign in from outside the office and anything with administrator rights. Those two groups are where a forgotten account does the most damage, and they are the ones an attacker looks for first.
Our IT audit checklist covers the account questions, and the staff leaver IT checklist deals with the human version of the same problem: the account that stays live after the person has gone.
A note on suppliers, from one
INDIGO IT is a managed IT support and cyber security provider in Camberley, Surrey, so this case is uncomfortable reading from our side of the table too. The honest conclusion is that a good supplier should hand you the account list without being asked, and a good customer should ask anyway. If your current provider cannot produce one within a day, that tells you something.
If you would like a second pair of eyes on the accounts in your Microsoft 365 tenant and on your servers, speak to Matt. If you would rather start on your own, the IT audit checklist is the place, and the account questions are the ones to do first.
Frequently asked questions
What is the ICO Password1 reprimand?
On 20 October 2026 the ICO reprimanded Ogi Networks and Data Cymru after a dormant test account from 2012, protected by the password Password1, was used to launch a ransomware attack on 1 November 2024. Data on about 3,300 people, mostly children, was stolen. Both organisations were reprimanded rather than fined.
Why was the customer reprimanded as well as the IT supplier?
The ICO found that the supplier created and never audited the account, while the customer owned the network, had irregular account reviews, and lacked the contract terms UK GDPR requires with a processor. Responsibility was shared, so both received reprimands.
How often should a small business review user accounts?
Cyber Essentials requires accounts that are no longer needed to be removed or disabled, and assessors ask how that is checked. A quarterly review of every account, including those created by suppliers, with a named owner for each, is a reasonable standard for a small business.
What is a dormant account and why is it dangerous?
A dormant account is one that still exists and can sign in but is no longer used, such as a test login, an old supplier account or a former employee’s login. Nobody watches it, its password is rarely changed, and it often has more access than anyone realises, which makes it an easy way in.
