Local Government Data Unit – Wales

Profile narrative

Data Cymru, also known as the Local Government Data Unit – Wales, operates as a shared intelligence and data service for the twenty-two principal local authorities across Wales. The organisation collects, analyses, and disseminates statistical information that supports evidence-based policy development, service planning, and performance management within Welsh local government. Its work spans demographic profiling, socioeconomic indicators, housing statistics, education outcomes, and social care metrics, providing a common evidence base that enables councils to benchmark performance and coordinate regional responses. The unit also maintains national data standards and supports mandatory reporting requirements placed on local authorities by the Welsh Government.

The unit's reach extends across the full breadth of local public services in Wales, making it a central node in the country's public sector information architecture. By aggregating data from individual councils, Data Cymru produces national datasets that inform Welsh Government strategy, scrutiny committees, and public accountability mechanisms. The organisation's role in managing sensitive personal and administrative data places it within a stringent regulatory environment governed by UK data protection legislation and Welsh-specific public sector obligations. Its operational model relies on collaborative governance, with funding and strategic direction shared among the constituent local authorities it serves.

In November 2024, Data Cymru experienced a significant ransomware intrusion that exploited a dormant test account secured only with the password "Password1," a credential estimated to be twelve years old. Attackers exfiltrated approximately 42 gigabytes of data and encrypted a further 182.7 gigabytes, disrupting systems that supported two major Welsh projects focused on children and families. The breach exposed personal information relating to roughly 3,300 individuals, the majority of whom were children, raising serious concerns about the protection of vulnerable populations' data. The incident underscored the critical importance of credential hygiene, legacy account management, and robust monitoring within organisations that steward sensitive public sector information.

Incidents

0 incidents linked to this organisation.