A test account created in 2012. A password of "Password1". Twelve years later, the way in for a ransomware attack that exposed information about around 3,300 people, most of them children.
In October 2026 the ICO reprimanded two Welsh organisations: Ogi Networks, an IT provider, and Data Cymru (the Local Government Data Unit – Wales), which it supported. These are reprimands, not fines. But they are one of the clearest examples yet of how responsibility is shared between an organisation and its IT provider, and of how ordinary the failures behind a serious breach can be.
What happened
- In January 2012, Ogi created a test account called "Test2" while setting up services for Data Cymru. It was given the password "Password1".
- The account was never removed. Local administrator accounts on the affected systems all shared one password, unchanged for more than 12 years.
- On 1 November 2024 an attacker used the test account to get into Data Cymru's network, took 42GB of data and then encrypted around 183GB with ransomware.
- The information related to two projects supporting children and families.
"Password1 is not an appropriate password, it is a wide-open door." ICO head of investigations
What the ICO found
The IT provider had no process to audit the accounts it created, and did not review local administrator accounts once they were set up. The ICO found it had not put appropriate security measures in place, or tested them regularly.
The customer kept overall control of its network, including the ability to ask the provider to create or remove accounts. But it had not clearly documented how the provider would manage and review those accounts, its own reviews did not cover every account, and it did not have the contract terms UK GDPR requires in place with the provider.
The ICO was clear that the responsibility was shared. Both organisations have since made changes, including multi-factor authentication, regular account reviews and a compliant contract signed in April 2025.
Why this matters if you have an IT provider
Most small and medium-sized organisations rely on an outside IT provider, so this pattern will feel familiar. The provider sets things up and does the technical work. You assume they are looking after it. They assume you will tell them when something is no longer needed. Accounts created for testing, migrations or one-off support jobs can sit in the gap between the two for years.
Outsourcing the work does not outsource the responsibility. As we set out in our article on supplier data breaches, the organisation in control of the data stays accountable for choosing its suppliers and putting the right terms in place.
Six things to do now
- Ask for a full list of accounts. Every user, administrator, service and test account on your systems, who it belongs to and when it was last used.
- Remove what is not needed. Test, temporary and former staff or contractor accounts should be disabled or deleted, not left dormant.
- Change default and shared passwords. No two administrator accounts should share a password, and none should still use the one set at installation.
- Turn on multi-factor authentication, at least for remote access and administrator accounts.
- Agree who reviews what. Write down who is responsible for reviewing accounts, how often, and how you will see the results.
- Check the contract. Make sure your data processing agreement with your IT provider covers security, sub-processors and breach notification.
Common questions
What is a reprimand? A formal, public finding that an organisation has broken data protection law. It does not carry a fine, but it is published, and it sets out what the organisation needs to put right.
We're not a public body. Does this apply to us? Yes. Nothing about these failings was specific to the public sector: an old account, a weak password and no one clearly responsible for checking. The same gaps exist in private businesses and charities.
Our IT provider says everything is fine. Is that enough? Not on its own. Ask to see the evidence: the account list, when it was last reviewed and what changed as a result. If the answer is unclear, that tells you something too.
If you are not sure what accounts exist on your systems, or what your contract with your IT provider says, a data protection audit will cover both. Or start with a free data protection review.
