Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

Information Commissioner reprimands Welsh bodies after legacy test account credentials enable ransomware compromise

Personal records belonging to 3,300 people were compromised after attackers breached an unmonitored test account secured by the password Password1, the Information Commission announced on 20 October 2026. Formal reprimands were issued to Ogi Networks Limited and the Local Government Data Unit Wales, known as Data Cymru, following the incident. The breach exposed data relating to vulnerable children and family support programmes across Wales.

Intruders executed the ransomware attack on 1 November 2024, encrypting 182.7GB of files and exfiltrating 42GB of data from Data Cymru processing environments. The intrusion succeeded by targeting a legacy account named Test2, which had persisted inside Active Directory for more than twelve years without credential updates or routine deactivation audits.

Investigators determined that Ogi Networks Limited infringed Articles 32(1)(b) and 32(1)(d) of the UK GDPR by neglecting password complexity standards and failing to audit accounts created inside customer networks. Local administrator accounts across three separate systems retained identical passwords for more than twelve years. Data Cymru infringed Articles 28(4), 32(1)(b) and 32(1)(d) of the UK GDPR by operating without a compliant data processing agreement governing subprocessor appointments and maintaining irregular account reviews that omitted substantial segments of Active Directory.

Remedial measures required both entities to implement multi factor authentication and establish formal contract terms, which were executed on 30 April 2025. The enforcement reflects administrative oversight powers transferred to the collective board of the Information Commission under the Data (Use and Access) Act 2025.

Legacy testing accounts regularly escape access reviews when organisations separate infrastructure management from Active Directory administrative control.

Information Commission reprimands under Articles 28(4), 32(1)(b) and 32(1)(d) of the UK GDPR

Who this binds
Controllers and processors operating in the United Kingdom are legally bound under the UK GDPR to maintain rigorous technical access controls and documented subprocessor contracts.
What changed
The Information Commission confirmed through formal reprimands that managing third party Active Directory environments without formal Article 28 terms or scheduled directory audits constitutes an enforceable security infringement.
What to check
Audit all Active Directory instances for legacy test accounts created prior to 2018 and confirm subprocessor contracts exist for all outsourced network administration services.
What this does not mean
This decision does not require controllers to eliminate external technical administration or terminate legacy subprocessor relationships that operate under fully documented contractual terms.

Send this to your team

The Information Commission reprimanded Data Cymru and Ogi Networks Limited under the UK GDPR after a dormant twelve year old test account with weak credentials caused a major data breach.

Today's question

Following a ransomware incident involving an unmonitored test account in an Active Directory environment, a regulatory authority issued formal reprimands to two organisations. According to the investigation findings, which specific failure contributed to the infringement under Article 28(4)?

  1. Operating without a compliant data processing agreement governing subprocessor appointments
  2. Neglecting password complexity standards across local administrator accounts on client systems
  3. Permitting an unmonitored administrative credential to persist without routine password updates
  4. Failing to establish multi factor authentication protocols across all external network points

Answer this question on the site

Worth knowing

  1. German supervisory authority declares political microtargeting unlawful across major parties

    The Berlin Data Protection Authority establishes that political parties require explicit consent under Article 9 of the GDPR to target voters using online behavioural tracking data.

  2. OPC introduces national privacy code for youth data handling

    Organisations subject to Canadian privacy law must adapt onboarding flows to secure opt in consent for secondary processing and eliminate behavioural profiling for minors under 13.

  3. Federal district court invalidates personnel data transfers to outside efficiency teams under federal privacy law

    United States federal agencies cannot rely on administrative modernisation goals to bypass Privacy Act interagency disclosure restrictions when transferring personnel databases to outside efficiency teams.

  4. Whitehall pursues modular digital identity credentials despite scrapping central programme

    United Kingdom data protection practitioners advising public bodies should prepare for distributed credential risk under individual department programmes even as the central government national identity card concept stalls.

  5. Frontier settles Connecticut breach probe for six hundred and twenty five thousand dollars

    Telecommunications privacy counsel operating across state borders face continuing state attorney general scrutiny over legacy customer records security even outside California statutory enforcement.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.