Local Government Data Unit – Wales

Summary

Ransomware attackers breached the network of Local Government Data Unit – Wales through a dormant test account protected by the password Password1, which had remained active for over a decade. The intrusion resulted in the encryption of 182.7 gigabytes of data and the exfiltration of 42 gigabytes containing personal information for 3,300 individuals, most of them children, tied to two projects supporting children and families. The Information Commissioner’s Office reprimanded both the organization and its third-party IT provider for GDPR infringements including weak password controls, infrequent account audits, and the absence of a compliant data processing agreement, though no financial penalty was issued. Following the incident, the parties implemented stronger access controls, multi-factor authentication, regular account reviews, and a legally compliant processing contract, with no evidence that the stolen data was further shared or misused.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On 1 November 2024, ransomware attackers gained initial access to the network of the Local Government Data Unit – Wales, known as Data Cymru, through a compromised test account identified as Test 2. The account had been created by Ogi Networks Limited, or ONL, in 2012 and had remained active for more than 12 years. It was protected solely by the password Password1. ONL had served as Data Cymru's third-party IT service provider since 2012. Once inside the network, the threat actor moved to encrypt 182.7 gigabytes of data held on file servers and an internal database SQL server. Before deploying the ransomware, the attackers exfiltrated 42 gigabytes of data from a primary domain controller, a file server, and an SQL server. The stolen information related to two projects supporting children and families in Wales and included the personal data of 3,300 people, the majority of whom were children. Data Cymru is funded by the Welsh government and is tasked with enabling local councils and other organizations to find, collect, analyze, and present data effectively.

The Information Commissioner's Office reprimanded both ONL and Data Cymru for security failings connected to the incident. ONL was found to have failed to apply appropriate password-strength and complexity requirements to the account and to have neglected regular audits of accounts it had created within Data Cymru's network, allowing the operationally unnecessary test account to remain in place for over a decade. ONL also did not review local administrator accounts after their initial deployment, with accounts on three affected systems using the same password for the same period. Data Cymru was criticized for not having a contract in place with ONL containing the legally mandated data protection terms required when appointing a sub-processor. The organization also failed to ensure the dormant test account was identified and removed or updated to meet stronger password requirements, and its account reviews were not scheduled or routine and did not cover the full contents of Active Directory. The ICO stated that the infringements by both organizations continued without being identified or addressed, and that responsibility for the failures did not sit with one organization alone. Neither organization received a financial penalty for the infringements.

Following the attack, both organizations introduced stronger security measures. ONL stated that within a week of the incident it worked with Data Cymru to check every account on the network and switched off the ones no longer needed on the same day. ONL also brought in independent cyber-security specialists to investigate. The company introduced a process prompting customers to review active accounts periodically and providing recommendations about accounts that should be removed. It strengthened its account access controls, including the use of multi-factor authentication. Data Cymru introduced periodic account reviews and strengthened account access controls, including using multi-factor authentication. On 30 April 2025, Data Cymru and ONL entered into a legally compliant data processing contract. Data Cymru merged with the Welsh Local Government Association in 2025, and a WLGA spokesperson said there was no evidence the stolen information was shared further or misused. The WLGA added that measures had been put in place to strengthen arrangements identified by the ICO, including the removal of dormant user accounts, strengthened password and remote user access controls, and improved data processing arrangements to clearly define contractual responsibilities for security and audit activities.

Sources

Sources available to members: 2 sources.