A Test Account Called Test2, Password Password1, Waited 12 Years. Then Ransomware Found It.

01 What the ICO found

Data Cymru helps public bodies in Wales use data. Ogi, a Welsh network provider, ran its server and connectivity infrastructure, licensing and support from 2012 [ The Register ] . Welsh councils fund and own Data Cymru, and its staff and functions moved into the Welsh Local Government Association in 2025, after the attack [ Local Government Lawyer ] .

The ICO split the blame. Ogi breached Articles 32(1)(b) and 32(1)(d) of the UK GDPR: weak password controls on the account, no audit of the accounts it had created in Data Cymru’s Active Directory, and no review of local administrator accounts after deployment. Data Cymru breached the same two provisions, plus Article 28(4). Its account reviews were unscheduled and partial, it had not documented who was responsible for the outsourced Active Directory service, and it had no compliant processor contract with Ogi [ ICO ] .

David Doodson, the ICO’s head of investigations, put it in one line: “Password1 is not an appropriate password, it is a wide-open door to nefarious actors.” He was just as clear on ownership. Ogi created the account. Data Cymru kept overall control of its network, including the power to tell Ogi to create or remove accounts. “Neither had put in place sufficiently clear and effective measures” to find and remove old ones [ ICO ] .

Both organisations have accepted the findings. The WLGA said there is “no evidence to indicate that the compromised information was shared further or misused.” Ogi said the incident “was limited to the server we hosted for Data Cymru” [ Local Government Lawyer ] . No source we read names the ransomware group.

02 Twelve years, one test account

Test2 had a job once. In January 2012 an engineer needed to prove a user could log in before the real accounts moved across. The test passed, the migration went ahead, and the account stayed. For almost 13 years it sat in the directory with a password that a free strength checker rates at under a second to crack [ The Register ] .

The account did not need to be powerful. It only needed to log in. Inside, the attacker met the second problem: the local administrator accounts on the three affected systems shared one password, unchanged for more than 12.5 years. Break one machine, collect the hash, and the same credential opens the next. That is how one forgotten login reached a domain controller, a file server and a database [ The Register ] .

Look for Test2’s relatives in your own directory. The names change: temp, scanner, demo, svc_backup, the installer account from the printer rollout, the login a contractor used in 2019. They share four traits. Nobody owns them. Nobody logs in with them, so nobody notices when someone else does. Their passwords were set by hand on day one and never rotated. And they often sit outside the multi-factor rules, because MFA would have broken whatever script or device they were made for.

03 The contract that was missing

The Article 28(4) finding is the part of this case most organisations will recognise in themselves. Data Cymru handled personal data on behalf of others. It brought in Ogi to run the infrastructure that data sat on. In UK GDPR terms that made Ogi a sub-processor, and the law requires the same data protection obligations to be imposed on a sub-processor by contract. The original processor stays “fully liable” for the sub-processor’s performance [ UK GDPR Art. 28 ] .

Data Cymru had no such contract with Ogi until 30 April 2025, almost six months after the attack [ ICO ] . For more than a decade, the firm running its Active Directory worked without written terms on security, audit or what happens to data at the end of the service.

Article 28(3) lists what that contract has to cover. Three items bear directly on this case [ UK GDPR Art. 28 ] :

• Security under Article 32. The provider takes the measures the law requires. Without terms, nobody wrote down who sets password policy, who reviews accounts or who removes test logins.
• Deletion at the end of the service. Personal data is returned or deleted when the job ends. The same logic applies to a migration: once it is finished, the scaffolding goes.
• Information and audits. The provider gives you what you need to demonstrate compliance and allows audits. A client who can audit asks for an account list. A client who cannot, does not.

The ICO’s own lesson from the case is blunt. Agreements with IT providers and sub-processors “should clearly explain how security controls will be delivered”, and that includes monitoring and audit [ ICO ] . If your MSP contract describes uptime and response times and says nothing about who reviews your accounts, you have the same gap Data Cymru had.

04 Reprimands, not fines. What you now have to prove

A reprimand carries no penalty. It is still a published finding that you broke the law, with your name on the ICO website and in the trade press the same afternoon. For a public body, or a provider that sells to public bodies, that page is one search away for the next buyer who checks.

Read the ICO’s six lessons as a list of things to evidence, and the expectation becomes concrete. Each one is a question an investigator, an auditor or a council procurement team can ask you after an incident [ ICO ] :

Data Cymru ran account reviews. The ICO still found against it, because the reviews were unscheduled and did not cover the full contents of Active Directory [ Infosecurity ] . A partial review that misses the one account an attacker uses counts for little. The standard is whole-estate, on a schedule, written down.

Article 32(1)(d) adds the testing duty: a process for regularly testing, assessing and evaluating whether your security measures work. Both organisations breached it. A policy that says “accounts are reviewed” is a claim. A test that tries Password1 against every account in the directory, and reports the result, is evidence.

05 The forgotten-account hunt, for MSPs and their clients

Ogi created Test2. Data Cymru owned the network. The ICO held both to account. If you are an MSP, every client tenant you built carries the same risk with your name on it. If you buy managed IT, you carry it whether or not you ever saw the account. Run these six checks this month. A “don’t know” counts as a fail.

1. Export every account. Pull all enabled user and service accounts from Active Directory and from Entra ID or your cloud identity platform, with creation date, last logon, password last set and owner. Sort by last logon. The bottom of that list is where Test2 lives.
2. Search the names. Filter for test, temp, demo, train, scan, svc, admin, setup and the names of suppliers and past projects. Anything without a named human owner gets disabled, then deleted after a short grace period.
3. Find passwords that never expire. Accounts with “password never expires” and a password last set years ago are the ones nobody has touched. Service accounts that need it should move to managed service accounts or a password vault.
4. Check local administrator passwords. If the same local admin password works on more than one server, one compromised machine gives an attacker the rest. Deploy Windows LAPS so each machine has its own, rotated automatically.
5. Close the MFA exceptions. List every account excluded from multi-factor rules and every remote access route that does not ask for it. The ICO says remote access should have MFA by default.
6. Read the contract. MSPs: check that each client agreement says who reviews accounts and how often. Clients: check that your provider contract carries Article 28 terms and gives you the right to audit. Then ask your provider for this month’s account review. If it does not exist, you have your answer.

A self-review finds the accounts you know to look for. An internal penetration test finds the ones you do not. We start with a single standard user, enumerate the directory the way an attacker would, try the commonly used passwords against every account, and follow shared admin credentials from server to server. In the Data Cymru case that path ran from a test login to the domain controller. In your network we show you where it runs, and how long it took. For the Cyber Essentials side of account control, and for how a single weak password emptied a national register, read Denmark and the password 123456.

Somewhere in your directory is an account made for a job that finished years ago. It still works. Get a free audit and we will find it, test it, and hand you the list before someone else logs in.