A cyberattack, facilitated by a test account active for over 12 years and protected by the password "Password1", led the British authority to issue a reprimand against the client and its IT provider for their shared failures in security and contractual oversight.

Facts and context

The British data protection authority, the Information Commissioner's Office (ICO), today published a reprimand decision against Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales (Data Cymru) for data security breaches that enabled a cyberattack.

The case follows a ransomware attack on November 1, 2024, which compromised the personal data of 3,300 individuals, mostly children, and resulted in the encryption of 182.7 GB of data.

Reasons for the decision

The investigation revealed that the attack exploited a test account named "Test2", created in January 2012 with the password "Password1", described as "very weak." This account remained active and vulnerable for over 12 years. The authority found that responsibility for this security breach was shared between the two entities.

For Ogi Networks Limited (ONL), as a processor:

• Obligation to ensure the security of processing (Article 32 of the GDPR): The authority judged that ONL did not implement appropriate technical and organizational measures. By creating an account with an obviously insufficient password and failing to conduct regular audits of accounts on its client's network, ONL allowed a critical vulnerability to persist for years, thus failing its obligation to ensure the confidentiality and integrity of systems and to regularly test the effectiveness of its measures.

For Data Cymru, as controller:

• Obligation to oversee processing (Article 28 of the GDPR): Data Cymru had not established a contract with ONL containing the data protection clauses required by the GDPR. Furthermore, the terms of provision, monitoring, and auditing of active directory management services were not clearly documented, creating a gap in the allocation of responsibilities between the two organizations.

• Obligation to ensure the security of processing (Article 32 of the GDPR): The authority reproached Data Cymru for not ensuring that the dormant test account was identified and deleted or brought into compliance with password complexity requirements. The account reviews conducted by Data Cymru were unplanned, inconsistent, and did not cover the entire active directory, constituting a failure to regularly test and evaluate the effectiveness of security measures.

Authority's decision

Consequently, the authority issued a reprimand against Ogi Networks Limited and Data Cymru.

Lessons learned

This decision reminds that:

• Managing the lifecycle of user accounts, including systematically deleting test accounts, dormant accounts, or former user accounts, is a fundamental security measure.

• The responsibility for security must be clearly defined and contractually allocated between the controller and its processors, notably regarding supervision and auditing of implemented measures.

• Implementing robust password policies prohibiting weak combinations and enabling multi-factor authentication for remote access are basic requirements to ensure system security.