A forgotten test account. The password was Password1. It let ransomware in.

What happened

In January 2012, Ogi Networks set up a test account called Test2 while onboarding a new customer, Data Cymru, the local government data unit for Wales. It was there to check that access worked before the real users were moved across. Its password was Password1.

Nobody removed it. More than 12 years later, in November 2024, an attacker found it and logged straight in. According to the Information Commissioner's Office (ICO), a password checker would have cracked it in under a second.

From there the attacker moved through the network, reaching a domain controller, a file server and a database server. They took 42GB of data, then encrypted a further 182.7GB with ransomware. The stolen data related to about 3,300 people, most of them children, from two projects supporting children and families.

On 20 October the ICO issued reprimands to both organisations, rather than fines. Its Head of Investigations, David Doodson, said: "Password1 is not an appropriate password, it is a wide-open door to nefarious actors."

It wasn't a clever attack

The ICO pointed to weaknesses in account management, password controls and security oversight. In plain English:

• An old account nobody needed was still switched on, twelve years after its job was done.
• The password was one of the first any attacker tries. There was nothing to block weak, common passwords.
• One login reached a lot. Once inside, the attacker could get to the servers that mattered.
• There wasn't a proper contract between the two organisations setting out who was responsible for protecting the data. That was only signed in April 2025, after the attack.

Since then, both have added multi-factor authentication (MFA), and Ogi says it has checked every account on the network and switched off the ones that weren't needed.

What this means for your business

Every business I've ever looked at has at least one account like Test2. The laptop login for someone who left in 2019. The "admin" account an old IT company set up and never mentioned. The shared mailbox with a password that's been on a sticky note since the office move.

They're easy to forget because nobody uses them. That's exactly why attackers like them: nobody notices when they're used.

The supplier point matters too. If an IT provider manages your systems, or you manage systems for your customers, someone should be checking what accounts exist and whose job it is to tidy them up. Write it down.

This is most of what the user access part of Cyber Essentials asks for: only the accounts you need, strong passwords or MFA on each, and admin rights only where they're needed.

Five things to check this week

1. List every account. In Microsoft 365 or Google Workspace, export the user list and read it. Anything you don't recognise, or that belongs to someone who's left, gets switched off.
2. Look for test, temp and admin accounts on your server, your Wi-Fi, your firewall and any software you log in to. Ask your IT provider for their list too.
3. Turn on MFA everywhere it's offered, starting with email and anything with admin rights. A guessed password is far less use to an attacker with MFA in the way.
4. Block the obvious passwords. Microsoft 365 already bans the most common ones for cloud accounts. On older systems, set a minimum length and check the defaults have been changed.
5. Put a date in the diary. Review accounts every few months, and every time someone leaves or a supplier changes.

If you'd like a quick outside view of your email setup, run your domain through the free email security checker. And if you think someone may already be using an account they shouldn't, treat it as a cyber incident.

Sources

• ICO: "Password1 is not an appropriate password"
• The Register: 'Password1' and a forgotten test account land Welsh outfits in hot water
• Nation.Cymru: Two Welsh organisations reprimanded after cyber-attack exposed children's information