Securityransomwarepasswordsactive-directoryvpnico
Ransomware Hit Welsh Local-Government Data Unit Data Cymru Through a Test Account Named Test2 With the Password Password1, Left Active for 12.5 Years
Its IT contractor made the account in January 2012 to test logins before real users moved over, and nobody ever turned it off. Attackers took 42 GB covering about 3,300 people, most of them children.
Ogi told the Information Commissioner’s Office it “created the “Test2” account on 13 January 2012,” and that it was “likely intended to test user account access before migrating “real” users to its services.” It got “Password1” the day it was made.
Data Cymru had a perfectly decent password rule by the time it mattered: 15 characters, enforced by Group Policy. Test2 never had to meet it. The account “predated the implementation of the enhanced password requirements and, due to its lack of use, had not logged into the domain,” the Data Cymru reprimand says, so its password was never updated. It “continued to exist on Data Cymru’s network for 12.5 years.”
Attackers found it with password spraying, trying one common password against lots of accounts. Investigators at PureCyber traced first access to “a FortiClient VPN connection under the username “Test2”,” with activity “as early as 20 September 2024,” and a second old account, “testtest” from 2015, lit up four days later.
From there the domain controller, file server and SQL server fell in turn. “The local administrator accounts on the three impacted systems all had the same password,” the Ogi reprimand says, so once one system was breached its hashes worked on the others. Ogi “did not carry out any reviews of local administrator accounts” after setting them up in January 2012.
On 1 November 2024 the ransomware encrypted 182.7 GB. Before that, 42 GB had already gone out the door, covering “3,300 data subjects, the majority of whom were children.” The ICO’s own announcement says the data related to “two projects supporting children and families.”
The cleanup took less than a workday. On 8 November, Ogi sent Data Cymru a list of every Active Directory user, Data Cymru marked the dead ones, and Ogi removed them the same day. The reprimand says it “took just over four hours.” It turned up eight deprecated accounts, one of them a web development consultant’s with admin rights. Tarian, the regional organised crime unit, and the National Cyber Security Centre are watching the dark web, and so far “There is no evidence of personal data being published to date.”
Doodson’s line, “Password1 is not an appropriate password, it is a wide-open door to nefarious actors,” will get quoted a lot, but reprimands like these two point at the more boring fix. The ICO decided a reprimand was “the most appropriate course of regulatory action” for both, so the price both paid was the remediation, a rewritten contract and their failures published in detail.
That leaves the cheap work on everyone else’s desk. An account audit that takes four hours is easy to skip for twelve years, and every organisation that moved its IT to a provider around 2012 likely has its own Test2 somewhere. Data Cymru’s own functions moved to the Welsh Local Government Association on 1 April 2026, and the reprimand doesn’t say whether that move started with an account review.