Ogi Data Breach: How a “Password1” Account Exposed 3,300 People

A single forgotten login, protected by one of the weakest passwords imaginable, has led to the theft of sensitive data about thousands of people in Wales, most of them children. The UK’s data protection regulator has reprimanded IT provider Ogi Networks and Welsh local government body Data Cymru over the attack. The Ogi data breach has gone viral because of how it happened: a test account using “Password1” that sat unnoticed for more than a decade. The Password1 breach is a striking lesson for every business. Here is what happened and what organisations should learn from it.

What Happened

The Information Commissioner’s Office, the UK’s privacy regulator, published its findings on 20 October 2026. It found that hackers used an obsolete test account to break into the network of Data Cymru, the Local Government Data Unit for Wales, in a ransomware attack in November 2024, as The Register reported.

The attackers stole personal information relating to about 3,300 people, most of them children. Ogi Networks provided servers, connectivity and technical support to Data Cymru, and had created the account years earlier.

A 12-year-old account with a weak password

The account, called “Test2”, was created in January 2012. It was either left active throughout its life or accidentally reactivated before the attack. Its password was “Password1”. The regulator also found that local administrator accounts shared passwords across systems, which meant that once attackers broke into one system, they could use stolen credentials to move to others.

What the Regulator Found

The ICO said responsibility was shared. Ogi Networks created and managed the test account and other technical identities, but did not routinely review accounts it had created within Data Cymru’s network. The regulator found Ogi breached UK data protection law by failing to keep appropriate security safeguards and to regularly test them, according to Techopia.

Data Cymru kept overall control of its network and could tell Ogi to create or remove accounts. The ICO found it also lacked a contract with Ogi containing the data protection terms required by law.

A reprimand, not a fine

Both organisations received formal reprimands rather than fines. Ogi accepted the findings, saying the test account should have been deleted long before criminals used it. It said the incident was limited to a server it hosted for Data Cymru, and that its other customers’ data was not affected.

What Ogi Has Changed

Ogi says that within a week of the attack it checked every account on Data Cymru’s network and switched off those no longer needed. It also brought in independent cyber security specialists, introduced multi-factor authentication for remote access and now runs regular account reviews for customers whose networks it manages.

Lessons for Every Organisation

This breach did not need advanced hacking. It relied on basic security failures that many organisations share. The key lessons:

• Delete old accounts. List every account, including test, demo and supplier logins, and remove any that are not in active use.
• Ban weak passwords. Enforce strong, unique passwords and block common ones like “Password1”.
• Never share admin passwords. Each system should have its own credentials.
• Turn on multi-factor authentication, especially for remote access.
• Review supplier access. Know which accounts your IT providers create, and audit them regularly.
• Put contracts in place. Make sure agreements with suppliers include clear data protection terms.

These lessons apply well beyond the UK. Strong basics would have stopped this attack, just as quick patching protects against threats like the PHP2Shell flaws affecting websites this week. Our report on spyware hidden in online ads covers another side of modern threats, and our cybersecurity tips for small businesses guide covers more steps.

A Simple Mistake With Serious Consequences

The Ogi and Data Cymru case shows how a long-forgotten account and a weak password can expose the personal information of thousands of children. The fixes are simple, but they only work if someone checks. Review every account your organisation has, delete what you do not need, and make strong passwords and multi-factor authentication the rule.

Frequently Asked Questions

Were Ogi broadband customers affected?

Ogi says the incident was confined to a server it hosted for Data Cymru, and that its other customers’ information was not affected.

How many people were affected?

About 3,300 people, most of them children.

Were the companies fined?

No. The ICO issued formal reprimands rather than fines.

When did the attack happen?

The ransomware attack took place in November 2024. The ICO published its findings on 20 October 2026.