decrypted · 20 october 2026 · ransomware and cybercrime · vulnerabilities and patching · uk policy and law

The ICO's verdict on a twelve-year-old test account called Test2

The Information Commissioner's Office, the UK's data regulator, published reprimands today over a ransomware attack on Data Cymru, the Local Government Data Unit for Wales, and its IT supplier, Ogi Networks Limited. The way in was a test account called Test2, protected by the password Password1. That is easy to dismiss as carelessness. It is better read as a design failure that sat unnoticed for more than twelve years, and one that plenty of organisations could reproduce.

How the attack worked

On 1 November 2024 an attacker used the Test2 account to get into Data Cymru's network. The ICO said the account had existed for over twelve years, and that a third-party tool rated its password very weak, crackable in under a second. The attacker took 42 gigabytes of data, then encrypted 182.7 gigabytes. Personal information of 3,300 people was taken, most of them children.

Think of a contractor who cuts a spare key during a building fit-out, labels it "test" and leaves it under the mat. Twelve years later nobody remembers it exists, because nobody owns the list of keys. The lock was never the problem. The missing inventory was.

Whose job was it?

The ICO said Ogi Networks created the account, while Data Cymru controlled the wider network, and that neither had clear, effective measures to find and remove old accounts. Each side could reasonably assume the other was watching. Supplier contracts rarely say who audits accounts, so often nobody does. Both bodies received reprimands rather than fines, but a reprimand is a public record that customers, insurers and auditors can read.

What the defender sees

Very little. A forgotten test account logging in looks like ordinary activity to a system built to trust it, so detection comes from inventory rather than alerts: every account, who owns it, when it was last used. The ICO's own recommendations are plain:

Remove unneeded test, dormant and former-user accounts.
Block weak and commonly used passwords.
Require MFA, multi-factor authentication, a second check on top of the password, for remote access.
Review all accounts, permissions and security groups, not a sample.
Give privileged accounts unique credentials rather than shared ones.

The Secure by Design lesson

Secure by Design means the safe state is the default, not a clean-up project. Test accounts should be created with an expiry date. Weak passwords should be refused by the system, not discouraged by a policy document. Contracts with IT providers and sub-processors should say who owns security duties and data protection terms, which is again the ICO's advice.

The cost is modest: an afternoon to export every account, a quarterly review, and a clause in the supplier contract. The cost of skipping it was a regulator's name on your file and the data of children in an attacker's hands. Opinion, not advice: ask your IT provider this week for a list of every account on your network, and who they think owns each one.

Also this week

Backup software, tampered at source. Researchers at ManageEngine's Threat Analysis Lab, working with Google Threat Intelligence Group and Mandiant, described how attackers altered the files AOMEI Backupper fetches from the vendor's update servers, during short windows that lasted minutes. Nothing was exploited in the usual sense: the client did not cryptographically verify those configuration files, and the checksum sat inside the same unsigned file as the download link. The ManageEngine analysis observed affected versions from 8.3.0 onwards and said AOMEI reported corrective action, which the authors have not independently verified. A server-side fix does not clean machines that already received the payload, so check your estate for the indicators the researchers published. The design lesson: sign the instructions as well as the software.

Fridges as a cyber target. From 11 October, attackers remotely triggered defrost cycles on refrigeration controllers made by Danfoss at French supermarkets, reportedly affecting 250 to 350 stores according to French outlets. Danfoss said the targeted models were obsolete or not updated. Two earlier flaws in the same controller family, CVE-2025-41450 and CVE-2025-41451 (a CVE being the public reference number every known vulnerability gets), had been public since 2025. A researcher counted 2,752 such systems exposed online, 1,590 of them in France, and the Paris prosecutor has opened an investigation. The question for any UK retailer or caterer is dull and urgent: is your OT, the operational technology that runs machinery, reachable from the internet, and who patches it?

Sources

If you want help auditing accounts and supplier duties before a regulator does, get in touch.