'Password1' and a forgotten test account land Welsh outfits in hot water
The Local Government Data Unit – Wales (Data Cymru) suffered a November 2024 ransomware attack after attackers exploited the 'Test2' account, which had been created in 2012 with an extremely weak password and never disabled. The attacker extracted 42 GB of data before encrypting 182.7 GB across multiple servers. The Information Commissioner's Office reprimanded both Data Cymru and its infrastructure provider Ogi Networks Limited, citing poor password hygiene and account management practices.
Key points
- Test account created in 2012 with password 'Password1' remained active and was exploited in ransomware attack
- 3,300 people's data compromised, including many children
- ICO issued reprimands rather than fines to both organizations involved
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Register did the reporting; read the original for the full story.
Read the full story at The Register
