A recent enforcement action by the UK's Information Commission's Office (ICO) serves as a stark reminder that significant cyber security and data protection incidents are not always caused by sophisticated attacks. Sometimes, the root cause is much simpler.

The ICO recently reprimanded Data Cymru and its IT service provider, Ogi Networks Limited, following a ransomware attack that resulted in the compromise of personal data relating to approximately 3,300 individuals, the majority of whom were children. The attack originated through a long-forgotten test account protected by the password "Password1".

While the facts of the case may seem unusual, the issues identified by the regulator are common across organisations of all sizes. The incident provides a useful opportunity for businesses to consider whether their own technical and organisational measures remain fit for purpose.

What happened?

According to the ICO's findings, attackers gained access to Data Cymru's network through a test account that had reportedly remained active for more than a decade. The account was protected by the password "Password1" and was no longer operationally required.

After obtaining access, the attackers were able to infiltrate the network, exfiltrate data and deploy ransomware across multiple systems. The incident resulted in the theft of personal information connected to projects supporting children and families across Wales.

The ICO concluded that both organisations had failed to implement appropriate measures to protect personal data, leading to infringements of UK GDPR requirements.

Why this matters

Cases involving ransomware often attract attention because of the actions of the attackers. However, the ICO's investigation focused squarely on the preventative measures that should have been in place before the incident occurred.

The regulator highlighted concerns including:

• weak password controls;

• the continued existence of unnecessary legacy accounts;

• inadequate account review processes;

• insufficient oversight of administrative privileges; and

• governance and contractual shortcomings relating to outsourced IT services.

These are not highly technical failings. They are governance, compliance and operational issues that many organisations encounter as systems, suppliers and personnel change over time.

As the ICO noted, a single weak password attached to an account that was no longer needed effectively provided an open door for attackers.

The wider lesson for organisations

Many businesses invest significant effort in modern cyber security controls such as endpoint protection, threat detection and vulnerability management. While those measures remain important, regulators continue to expect organisations to demonstrate that fundamental controls are working effectively.

Businesses should consider whether they can confidently answer the following questions:

• Are all user accounts still required and appropriately authorised?

• How frequently are privileged and administrator accounts reviewed?

• Are password policies regularly assessed against current security standards?

• Is multi-factor authentication enabled wherever possible?

• Do supplier arrangements clearly allocate security and data protection responsibilities?

• Can the organisation evidence its ongoing monitoring and governance activities?

These questions are particularly important where personal data is processed by third-party IT providers or managed service providers.

Data protection is about governance as well as technology

One of the most notable aspects of this case is that the ICO's findings extended beyond purely technical failings.

The regulator also criticised governance arrangements, including deficiencies in contractual arrangements and oversight between the organisations involved.

This reflects a broader trend in regulatory enforcement. Organisations are expected not only to implement appropriate technical measures but also to demonstrate accountability through documented processes, supplier management, risk assessments and ongoing monitoring.

Cyber security and data protection cannot be treated as separate disciplines. Effective compliance increasingly depends on both operating together.

A timely reminder

Although the incident itself arose in the public sector, the underlying issues are relevant to organisations across all sectors.

Dormant accounts, historic permissions, weak authentication controls and unclear supplier responsibilities are common risks that often remain hidden until an incident occurs.

The case serves as a useful reminder that strong cyber resilience does not always depend on complex solutions. Sometimes the most effective protections come from regularly reviewing the basics.

How can CG help?

Our team regularly supports organisations in strengthening their data protection and cyber governance arrangements. We are well placed to help businesses identify and address the types of issues highlighted by this case, including:

• reviewing information governance and cyber security arrangements against UK GDPR requirements;

• reviewing supplier contracts and data processing arrangements;

• delivering practical staff training on cyber security, data protection and accountability obligations;

• conducting gap analyses and compliance reviews to identify areas of risk; and

• supporting organisations following security incidents or personal data breaches.

If you would like to review your organisation's existing arrangements or discuss how these lessons may apply to your business, please contact dataprotection@cgprofessional.co.uk or your usual CG contact.