The recent breach of personal details affecting thousands of children and their families in Wales has shed light on significant cybersecurity deficiencies within two organizations. This breach was uncovered through an investigation by the UK’s Information Commissioner’s Office (ICO), which exposed how a weak password was the main entry point for ransomware attackers.
The ICO has formally reprimanded Ogi Networks Limited (ONL), the third-party IT service provider, and the Local Government Data Unit – Wales, commonly referred to as Data Cymru, for their security failings linked to the cyber incident that occurred in November 2024. These organizations are crucial in handling sensitive data, particularly that of minors, and the repercussions of their negligence are profound.
Data Cymru operates with funding from the Welsh government, focusing on equipping local councils and associated organizations with the tools necessary to efficiently collect, analyze, and present data. For over a decade, ONL has fulfilled the role of Data Cymru’s IT service provider, ostensibly ensuring the safety and integrity of the data being processed.
### Incident Details: A Weak Link
The investigation revealed that the attackers initially penetrated Data Cymru’s network through a compromised test account labeled ‘Test 2’. This account had been operational for more than 12 years and was guarded solely by a password that is widely recognized as weak: ‘Password1’. The security lapse allowed the cybercriminals to access the organization’s network and encrypt a staggering 182.7GB of data stored across various servers, impacting an internal database as well.
Before deploying their ransomware, these attackers managed to exfiltrate 42GB of sensitive information, extracting data from a primary domain controller, a file server, and an SQL server. The compromised information related to two significant projects aimed at supporting children and families in Wales, with personal data belonging to approximately 3,300 individuals, predominantly children, being involved.
### Criticism and Accountability
David Doodson, head of investigations at the ICO, voiced strong criticism of both ONL and Data Cymru, emphasizing that “Password1 is not an appropriate password; it is a wide-open door to nefarious actors.” He highlighted the grave implications of a single weak password associated with an outdated account, noting how it led to a serious breach that has affected a vulnerable population.
### Regulatory Findings: A Call for Better Security Practices
Upon investigation, both organizations were found to have violated several provisions of the UK General Data Protection Regulation (UK GDPR). ONL’s shortcomings included the failure to enforce suitable password strength and complexity requirements for user accounts. Moreover, the organization did not conduct regular audits of the accounts created within Data Cymru’s network, allowing the persistent existence of the unnecessary test account over such an extended period.
Additionally, ONL failed to review local administrator accounts once they were initially set up, leading to other vulnerabilities. As for Data Cymru, it fell short by not having a legally compliant contract with ONL containing the required data protection terms for engaging a sub-processor. Furthermore, the organization conducted sporadic account reviews that lacked scheduling and did not thoroughly examine the entirety of Active Directory’s contents.
In its reprimand, which was made public on October 20, the ICO noted that the issues identified in both organizations went unrecognized and unaddressed prior to the incident. Despite the severity of these breaches, neither agency has faced financial penalties. Nonetheless, the ICO pointed to remedial actions taken post-incident, including ONL enhancing its account access controls and the establishment of a legally compliant data processing contract between ONL and Data Cymru.
### Lessons Learned
In light of the breach, Doodson offered critical insights applicable to all organizations, stressing the importance of employing strong passwords, enhancing remote access security with multi-factor authentication, routinely reviewing user accounts, and clarifying cyber security responsibilities when outsourcing services. He reinforced that fundamental cybersecurity measures are not simply optional; their absence can lead to detrimental consequences.
The incident involving Data Cymru and Ogi Networks Limited serves as a stark reminder of the vulnerabilities inherent in data management practices and the absolute necessity for robust cybersecurity protocols, especially when safeguarding sensitive information pertaining to children and vulnerable populations.