On 20 October 2026 the Information Commission’s Office (ICO) published reprimands against two Welsh organisations after a ransomware attack. One was the IT provider. The other was its customer, which never had a proper data protection contract with that provider. Here’s what happened, and what to check in your own business, with no daft jargon.
What happened?
The Local Government Data Unit – Wales, known as Data Cymru, helps councils and public bodies in Wales use data. Ogi Networks Limited (ONL) had been its third-party IT provider since 2012, supplying hosted IT, licensing and support (ICO reprimand: Data Cymru) (The Register).
The way in: on 13 January 2012 ONL created an account called ‘Test2’, probably to test access before moving real users across. It was given the password ‘Password1’, and it was never removed. It had remote access through the VPN (ICO reprimand: ONL).
The attack: the account was most likely broken by password spraying, where attackers try a few common passwords against lots of accounts (ICO reprimand: ONL) (NCSC). ONL’s investigators found Test2 activity from 20 September 2024. Ransomware went off on 1 November 2024 (ICO reprimand: ONL).
The damage: 182.7GB of data was encrypted and 42GB was stolen first. It covered 3,300 people, most of them children, from two projects supporting children and families (ICO).
Making it worse: the three affected servers’ local admin accounts shared one password, unchanged since 2012, so one break-in opened the others (ICO reprimand: ONL).
According to the reprimand, there’s no evidence so far of the data being published, and the dark web is being monitored (ICO reprimand: Data Cymru). Data Cymru’s work has since passed to the Welsh Local Government Association, which told the BBC there was no evidence the information was “shared further or misused” (BBC News).
Who was reprimanded, and for what
Ogi Networks infringed UK GDPR Articles 32(1)(b) and 32(1)(d): it didn’t have proper measures to keep its processing systems secure, and it didn’t regularly test whether its measures worked. It set a weak password, had no audits of the accounts it created on Data Cymru’s network, and never reviewed the local admin accounts (ICO) (UK GDPR Art. 32).
Data Cymru infringed Articles 28(4), 32(1)(b) and 32(1)(d). Top of the list: it did not have a contract with ONL containing the legally required data protection terms. It also didn’t document how ONL’s Active Directory service (the system that controls who can log in) would be delivered, monitored or audited, and its own account reviews weren’t scheduled and didn’t cover everything (ICO) (UK GDPR Art. 28).
Both got reprimands, not fines (The Register), and both have since brought in account reviews and multi-factor authentication (MFA) (ICO).
What the ICO said
David Doodson, Head of Investigations at the Information Commission’s Office, said: “Password1 is not an appropriate password, it is a wide-open door to nefarious actors.” He added: “The responsibility for these failures did not sit with one organisation alone. ONL created the test account whilst Data Cymru retained overall control of its network, including the ability to instruct ONL to create or remove accounts. Neither had put in place sufficiently clear and effective measures to ensure that old accounts were routinely identified and removed.” (ICO)
And his advice: “The lesson for every organisation is straightforward: use strong passwords, protect remote access with multi-factor authentication, regularly review every user account, and be completely clear about who is responsible for cyber security when services are outsourced.” (ICO)
The real lesson: nobody wrote down who was responsible
It’s easy to laugh at ‘Password1’. But read the Data Cymru reprimand and a different story comes out. The only contract Data Cymru could produce was a 2016 order form for “Managed Hosted IT Services – AD Rights Management”. It said nothing about how that service would be delivered by ONL, or how Data Cymru would monitor or audit it (ICO reprimand: Data Cymru).
It fell through the cracks. When GDPR arrived in 2018, Data Cymru reviewed its contracts, but the order form was overlooked. It thought ONL was just an infrastructure provider, not someone handling personal data on its behalf. It stayed that way for nearly seven years (ICO reprimand: Data Cymru).
Each side assumed the other had it. ONL only created or removed accounts when Data Cymru told it to. ONL’s own password policy covered its own accounts, and it couldn’t simply enforce it on a customer’s network. The ICO says this left “a gap in the account auditing process between both organisations” (ICO reprimand: ONL).
The gap caused the breach. The ICO found the lack of documentation “created a gap in the parties’ processes and allocation of responsibilities”, which it “considers directly contributed to the Incident” (ICO reprimand: Data Cymru).
A contract wouldn’t have changed the password by itself. But one that said who reviews accounts, how often, and how the customer checks it would have made someone own the job. Nobody did, for 12 years.
What a data protection contract must cover
If a supplier handles personal data for you, UK GDPR Article 28 says there must be a written contract (UK GDPR Art. 28). In this case Data Cymru was itself working for other organisations, so ONL was a “sub-processor” and Article 28(4) applied, but the terms are the same. The ICO says the contract must set out what is being processed, why, for how long, and whose data, plus terms that the supplier (ICO):
only acts on your documented instructions, keeps the data confidential, and takes appropriate security measures;
only uses other suppliers with your permission, under the same terms;
helps you with breaches and data rights requests, and deletes or returns data at the end; and
gives you the information you need to check compliance, and allows audits.
The ICO says a written contract matters so that both sides “understand their obligations, responsibilities and liabilities” (ICO reprimand: Data Cymru) (ICO). Our view: if your IT provider can log in to systems holding customer, staff or patient information, treat it as handling personal data for you and get those terms in writing. Data Cymru and ONL now have a compliant agreement, but it was only signed on 30 April 2025, six months after the attack (ICO).
How we handle this with MSL Care Complete
This is exactly the gap our managed support package, MSL Care Complete, is built to close. It includes a written client agreement, agreed with each client, covering data protection terms, DPIAs (data protection impact assessments), GDPR policy and procedures. The security jobs are split and documented: MSL manages patching, Huntress managed EDR, your network devices and the documentation of your IT setup, and you stay responsible for your own users and data. Old accounts don’t get forgotten, because they come up through our monitoring, our documentation and a quarterly IT review with you.
The other lessons, for every small business
1. Hunt down old and test accounts
Test2 sat there for over 12 years. When the two organisations finally reviewed every account after the attack, it took just over four hours and found eight out-of-date accounts that should have gone, one of them with admin rights (ICO reprimand: Data Cymru). Review every account at least quarterly: leavers, test accounts, suppliers’ accounts and admin accounts, not just the main staff list.
2. Block weak and common passwords
The ICO says password controls should stop easily guessed passwords like ‘Password1’ being used at all (ICO). The NCSC recommends blocking the most common passwords with a deny list, rather than relying on complexity rules that people get round (NCSC). And give every admin account its own unique password, so one break-in doesn’t unlock everything.
3. Put MFA on remote access
The attacker came in through the VPN with just a username and password. The ICO wants MFA on remote access “by default” (ICO), and the NCSC has clear guidance on choosing strong MFA (NCSC). Both organisations now use MFA for remote access (ICO reprimand: ONL).
4. Test your controls, don’t just have them
Data Cymru did have a 15-character password policy. But Test2 never logged in, so it was never forced to change its password (ICO reprimand: Data Cymru). A rule nobody checks isn’t a control. Article 32(1)(d) requires “a process for regularly testing, assessing and evaluating” your security measures (UK GDPR Art. 32).
Your ‘Password1’ checklist
- Find your IT contract and check it includes the Article 28 data protection terms.
- Write down who does what: accounts, patching, backups, firewall, and who checks it.
- Review every account (test, old, supplier and admin) and remove what isn’t needed.
- Block common passwords, and give every admin account a unique one.
- Turn on MFA for remote access, email and admin accounts.
- Put a date in the diary to test your controls and review accounts every quarter.
References
- Information Commission’s Office, news: “‘Password1’ is not an appropriate password”, 20 Oct 2026
- Information Commission’s Office, Reprimand: Local Government Data Unit – Wales, 14 Oct 2026 (PDF)
- Information Commission’s Office, Reprimand: Ogi Networks Limited, 14 Oct 2026 (PDF)
- BBC News, “Hackers steal children’s data after company used ‘Password1’ to protect old account”, 20 Oct 2026
- The Register, “‘Password1’ and a forgotten test account land Welsh outfits in hot water”, 20 Oct 2026
- UK GDPR, Article 28: Processor (legislation.gov.uk)
- UK GDPR, Article 32: Security of processing (legislation.gov.uk)
- Information Commission’s Office, “What needs to be included in the contract?”
- Information Commission’s Office, “Contracts and liabilities between controllers and processors”
- National Cyber Security Centre, “Password policy: updating your approach”
- National Cyber Security Centre, “Multi-factor authentication for your corporate online services”
Need a hand applying any of this to your business? Get in touch — call +44 1472 564538 or email services@msl.org.uk.