Weak Password and Test Account Lead to Data Breach and Regulatory Reprimands in Wales
A ransomware attack on Data Cymru, enabled by a decade-old test account with a 'Password1' password, resulted in the exfiltration of 42 GB of sensitive data and drew reprimands from the ICO for both Data Cymru and its IT provider, Ogi Networks Limited.
A critical security lapse involving a forgotten test account and an easily guessable password has led to a significant data breach and subsequent regulatory action against two Welsh organizations. The Information Commission's Office (ICO) issued reprimands to Ogi Networks Limited (ONL) and Data Cymru, highlighting failures in implementing appropriate technical and organizational measures to protect personal data.
The incident occurred on November 1, 2024, when a threat actor exploited a test account named 'Test2' to gain access to Data Cymru's network. This allowed the intruder to encrypt a substantial amount of data, totaling 182.7 GB across a file server and an internal database. Prior to deploying ransomware, the attacker exfiltrated 42 GB of data from a primary domain controller, a file server, and an SQL server, impacting approximately 3,300 individuals, many of whom were children.
Investigations revealed that the 'Test2' account was created by ONL in January 2012, during the initial setup for Data Cymru. The account was assigned the password 'Password1', which security experts, including Bitwarden's password strength tool, deemed "very weak" and crackable in less than a second. This egregious oversight provided an immediate entry point for the attacker.
Compounding the issue, the local administrator accounts on the three affected systems shared the same weak password. This configuration allowed the threat actor to move laterally across the network with ease once initial access was gained, collecting hashes and authenticating to other systems. ONL admitted to not conducting regular reviews of these local administrator accounts after their initial deployment, leaving them active with their original default passwords for over 12.5 years.
The ICO reprimanded ONL under Article 32 of the UK GDPR for failing to implement adequate technical and organizational measures to secure processing systems and services, and for not regularly assessing or evaluating these measures. The regulator noted ONL's lack of auditing procedures for reviewing user accounts within Data Cymru's Active Directory.
Data Cymru also faced an ICO reprimand, detailing its own security shortcomings. The ICO emphasized that the responsibility for the breach was shared, as ONL created the vulnerable account while Data Cymru retained overall network control and the ability to manage accounts. Neither organization had sufficiently robust processes for identifying and removing outdated accounts.
"Password1 is not an appropriate password, it is a wide-open door to nefarious actors," stated David Doodson, ICO head of investigations. He underscored how a single weak password on an unnecessary account could lead to severe cyber-attacks affecting thousands of individuals.
This incident serves as a stark reminder of the persistent risks associated with basic security hygiene, particularly the management of privileged accounts and the use of strong, unique passwords. The failure to address these fundamental vulnerabilities allowed a threat actor to access and exfiltrate sensitive personal data, resulting in significant regulatory scrutiny and reputational damage for both organizations.