'Password1' and a forgotten test account: lessons from a ransomware attack

By The KTech team · Published 29 October 2026

What happened

The Information Commissioner's Office (ICO) announced on 20 October 2026 that it had reprimanded Ogi Networks Limited and the Local Government Data Unit, Wales (Data Cymru) after a ransomware attack. Its write-up is titled Password1 is not an appropriate password.

According to the ICO, the attackers got in through an account called Test2, created back in 2012 and never removed. The password on it was Password1 the whole time. The ICO says personal information about 3,300 people was taken, most of them children.

The regulator found that neither organisation had clear, routine checks to spot and remove old accounts, and that the responsibilities between the two were not clearly set out. The ICO's Head of Investigations described the password as, in his words, "a wide-open door to nefarious actors".

Both organisations have since changed how they work, including regular account reviews and stronger sign-in controls such as multi-factor authentication.

What this means for South Hams homes and businesses

• List every account on your systems and remove the ones nobody needs: leavers, test logins, old suppliers and shared accounts.
• Use long, unique passwords, ideally from a password manager, and turn on multi-factor authentication wherever it is offered, especially for remote access and email.
• Review who has administrator rights. Fewer people with them means fewer ways in.
• If an outside IT firm manages your systems, write down who is responsible for what, including who removes old accounts.
• Make account clean-ups a diary item, a few times a year, instead of something that happens after an incident.

• Ransomware
• For businesses