Ethical Hacking News
ICO Cracks Down on Weak Passwords: A Cautionary Tale of Cybersecurity Failures. The Information Commission's Office has issued reprimands to two Welsh organizations for their roles in a ransomware breach that exposed the personal data of 3,300 people, mostly children. The incident highlights the importance of robust cybersecurity measures and the devastating consequences of weak passwords.
Two Welsh organizations, Ogi Networks Limited (ONL) and Data Cymru, were reprimanded by the ICO for their roles in a ransomware breach that exposed 3,300 people's personal data. The breach occurred due to a weak password, "Password1," used for a test account created by ONL in 2012, which was easily guessable by an attacker. The ICO found that both organizations failed to put in place adequate technical and organizational measures to ensure the safety of their systems and services. The incident highlights the importance of robust cybersecurity measures, including the use of strong passwords, regular account reviews, and effective auditing procedures.
The Information Commission's Office (ICO) has issued reprimands to two Welsh organizations, Ogi Networks Limited (ONL) and Data Cymru, for their roles in a ransomware breach that exposed the personal data of 3,300 people, mostly children. The incident highlights the importance of robust cybersecurity measures and the devastating consequences of weak passwords.
According to the ICO, the breach occurred when a miscreant exploited a test account called Test2 to infiltrate Data Cymru's network and encrypt 182.7 GB of data housed in a file server and an internal database server. The test account, which was created by ONL in 2012, was initially intended to test user account access before migrating "real" users to ONL's services. However, the password used for the account, "Password1," was woefully inadequate.
The ICO's investigation revealed that ONL created the test account with the password "Password1," which was deemed "very weak" by Bitwarden's password strength tool. The tool estimated a cracking time of less than a second, making it easily guessable by a determined attacker. Furthermore, the ICO found that the local administrator accounts on the three impacted systems all had the same password, which allowed the threat actor to authenticate access to other systems on the Data Cymru network.
The ICO's reprimand of ONL highlighted the organization's failure to put in place "appropriate technical and organisational measures" to ensure processing systems and services were safe. The ICO also found that ONL had no auditing procedures to review user accounts within Data Cymru's Active Directory, leaving the door open for further security breaches.
Data Cymru, on the other hand, was reprimanded for its own security failures, including the use of weak passwords and inadequate security arrangements. The ICO's investigation revealed that Data Cymru retained overall control of its network, including the ability to instruct ONL to create or remove accounts, but neither organization had put in place sufficiently clear and effective measures to ensure that old accounts were routinely identified and removed.
The ICO's reprimand of ONL and Data Cymru serves as a cautionary tale of the devastating consequences of weak passwords and inadequate cybersecurity measures. The incident highlights the importance of robust security arrangements, including the use of strong passwords, regular account reviews, and effective auditing procedures. It also underscores the need for organizations to take responsibility for their own cybersecurity failures and to work collaboratively with regulatory bodies to prevent similar incidents in the future.
In a statement, the ICO's head of investigations, David Doodson, noted that the incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands. He emphasized the importance of clear and effective security measures, saying, "Password1 is not an appropriate password, it is a wide-open door to nefarious actors."
The incident serves as a reminder that cybersecurity is a collective responsibility, and that organizations must prioritize robust security measures to protect their users' personal data. As the ICO continues to work with organizations to strengthen their cybersecurity, it is clear that weak passwords and inadequate security arrangements will no longer be tolerated.
Related Information:
https://www.ethicalhackingnews.com/articles/ICO-Cracks-Down-on-Weak-Passwords-A-Cautionary-Tale-of-Cybersecurity-Failures-ehn.shtml
https://www.theregister.com/cyber-crime/2026/10/20/password1-and-a-forgotten-test-account-land-welsh-outfits-in-hot-water/5304139
Published: Tue Oct 20 12:18:49 2026 by llama3.2 3B Q4_K_M
