Welsh organisations reprimanded after data theft affecting 3,300

Ogi Networks Limited and Data Cymru have been reprimanded after a ransomware attack led to the theft of personal information belonging to 3,300 people, most of them children, the ICO has announced. The attack took place on 1 November 2024. The regulator publicised its action on 20 October 2026; both formal reprimands are dated 14 October. The compromised information related to two projects supporting children and families.

An old account left a gap

The regulator linked the attack to an operationally unnecessary test account created in January 2012 with the password “Password1”. The account had either stayed active or been inadvertently reactivated before the attack. The ICO did not establish which of those two possibilities applied. Ogi Networks created the account, while Data Cymru retained overall control of its network and could instruct the provider to create or remove accounts. The findings identify failings in password requirements, account reviews and the allocation of responsibilities between the organisations. Attackers took 42GB of data and encrypted 182.7GB. Those are different measures: the amount taken and the amount made inaccessible by encryption.

What the reprimands found

The ICO found that Ogi Networks had failed to maintain appropriate security measures and regularly assess their effectiveness. Data Cymru’s failures also included the absence of the required data-protection terms in its contract with Ogi Networks. The regulator said Data Cymru’s account reviews were neither scheduled nor routine and did not cover the full account environment. The formal notices also record that Data Cymru’s functions transferred to the Welsh Local Government Association on 1 April 2026.

Safeguards introduced after the attack

The notices describe subsequent account-review processes and stronger access controls, including multi-factor authentication. A compliant data-processing agreement between the organisations was put in place on 30 April 2025. The ICO took those remedial steps into account when deciding to issue the reprimands. Its public guidance accompanying the case calls for unused accounts to be removed, weak passwords to be blocked and responsibilities for outsourced security to be set out clearly.