Summary

  • The ICO reprimanded Ogi Networks and Data Cymru over a 2024 ransomware incident in which information about 3,300 people was taken, most of them children.
  • Its findings describe failures on both sides of an outsourcing boundary: account and password controls at Ogi, and processor terms, monitoring and audit at Data Cymru.

The Information Commissioner’s Office says the incident occurred on 1 November 2024. A test account called “Test2,” created by Ogi Networks in January 2012, had retained the password “Password1” for more than twelve years. The ICO says it may have remained active or been inadvertently reactivated. The notice does not establish exactly how access was regained.

The account is only part of the finding. The ICO says information about 3,300 people was taken, most of them children, in relation to two projects supporting children and families. It reports that 182.7 GB was encrypted and 42 GB was taken from Data Cymru systems. Encryption and extraction are separate facts; the notice does not say that every affected service became unavailable or quantify harm to individuals.

The regulator divided responsibility across the service relationship. Ogi was reprimanded for breaching UK GDPR Article 32. The ICO cites insufficient account audits, weak password controls and incomplete reviews of local administrator accounts. Data Cymru was reprimanded for breaches of Articles 28(4) and 32. Its processor arrangements lacked required terms and did not clearly assign who would deliver, monitor and audit the service. The ICO also says Data Cymru did not ensure the dormant account was removed or updated, while account checks were unscheduled and incomplete.

That distinction matters. A provider may create credentials and operate technical controls, but the customer still needs a reliable way to know which accounts remain valid, who checks them and what evidence closes the loop. A contract that leaves monitoring or audit ownership unclear can let an old account persist between two organisations, even where each has some security duties. The ICO’s findings identify failures at both ends; they do not establish that either party alone caused every step of the incident.

The ICO says both organisations later reported corrective action. It issued reprimands rather than financial penalties. That response closes an enforcement stage, not the operational question: whether account ownership, expiry and review can now be demonstrated across the supplier boundary. The public notice reports no service outage, identifies no affected child, and does not quantify downstream consequences.

Sources: ICO announcement; ICO enforcement record for Ogi Networks