Data Cymru, the Local Government Data Unit – Wales, has been reprimanded by the data protection regulator after a ransomware attack exposed the personal information of 3,300 people, most of them children.
The Information Commission's Office (ICO) found the attack on 1 November 2024 exploited a test account that was protected by the password ‘Password1’. It reported that 42GB of data was taken from Data Cymru's systems, relating to two projects supporting children and families.
Investigators said Data Cymru kept overall control of its network but had no contract with its IT supplier, Ogi Networks, containing the legally required data protection terms. It also failed to clearly document how supplier-run services would be monitored or audited.
David Doodson, Head of Investigations at the ICO, said: ‘Password1 is not an appropriate password, it is a wide-open door to nefarious actors.
‘This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands.’
Data Cymru has since signed a compliant contract, introduced periodic account reviews and added multi-factor authentication.
