'Password1' and a forgotten test account land Welsh outfits in hot water

A test account protected by "Password1" helped an intruder steal personal data relating to 3,300 people, mostly children, in a ransomware attack that has drawn regulatory rebukes for two Welsh organizations.

The Information Commission's Office (ICO) issued reprimands rather than fines to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, also known as Data Cymru.

According to the ICO, altnet ONL provided server and connectivity infrastructure, licensing, and support to Data Cymru, which helps public bodies across Wales make effective use of data.

On November 1, 2024, Data Cymru suffered a ransomware attack after a miscreant exploited a test account called Test2 to infiltrate its network and encrypt 182.7 GB of data housed in a file server and an internal database server.

"Before deploying the ransomware, the threat actor exfiltrated 42 GB of data from a primary domain controller, a file server and an SQL server," the ICO said on Tuesday in its reprimand of ONL [PDF].

ONL told the ICO it created the test account on January 13, 2012, during its initial project for Data Cymru.

"ONL confirmed that the creation of the 'Test2' account was likely intended to test user account access before migrating 'real' users to its services," the ICO said. "When it was created, the 'Test2' account was given the password of 'Password1'."

The ICO cited Bitwarden's password strength tool, which rated "Password1" as "very weak" and estimated a cracking time of less than a second.

"The local administrator accounts on the three impacted systems all had the same password. This meant that once one system had been breached, the local account hashes could be collected and used by the threat actor to authenticate access to other systems on the Data Cymru network," the regulator added.

"ONL confirmed that it did not carry out any reviews of local administrator accounts following their initial deployment. This meant these accounts remained active, regardless of whether they were used, and continued to use the same default passwords set at the time of their creation in January 2012, as part of ONL's initial project with Data Cymru, for more than 12.5 years."

The data watchdog reprimanded ONL under Article 32 of the UK GDPR because it failed to put in place "appropriate technical and organisational measures" to ensure processing systems and services were safe, and it didn't regularly assess or evaluate those measures. It found ONL had no auditing procedures to review user accounts within Data Cymru's Active Directory.

The ICO's separate reprimand of Data Cymru [PDF] also detailed failures in its security arrangements.

"Password1 is not an appropriate password, it is a wide-open door to nefarious actors," said ICO head of investigations David Doodson. "This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands.

"The responsibility for these failures did not sit with one organisation alone. ONL created the test account whilst Data Cymru retained overall control of its network, including the ability to instruct ONL to create or remove accounts. Neither had put in place sufficiently clear and effective measures to ensure that old accounts were routinely identified and removed." ®