Context
The ICO has issued reprimands to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, following a ransomware attack. During the attack the personal information of 3,300 people was taken, the majority of whom were children.
Key points to note and next actions
- The attack exploited a test account, known as ‘Test2’, that had existed for more than 12 years and had either remained active since it was created or been inadvertently reactivated before the incident.
- It was found that throughout this period, the ‘Test2’ account was protected by the password ‘Password1’, which, when checked against a third-party password strength tool, was classified as ‘very weak’ and could be compromised in less than a second.
- The ransomware attack took place on 1 November 2024 and encrypted 182.7GB of data, with 42GB of data being taken from Data Cymru’s systems. The compromised information related to two projects supporting children and families.
- The ICO commented that ‘Password1’ is not an appropriate password, and that it is a “wide-open door to nefarious actors”.
Organisations should:
- Remove accounts that are no longer required: test, dormant and former-user accounts should be routinely identified and deactivated.
- Block weak and commonly used passwords: password controls should prevent easily guessed credentials such as ‘Password1’ from being used.
- Protect remote access: multi-factor authentication should be applied to remote access services by default.
- Audit the whole account environment: reviews should cover all relevant accounts, permissions and security groups, not just a limited subset.
- Avoid shared administrative credentials: privileged accounts should use unique credentials so that one compromised system does not provide access to others.
- Define responsibilities in contracts: agreements with IT providers and sub-processors should clearly explain how security controls will be delivered, monitored and audited, and include all legally mandated provisions.