ICO reprimands Data Cymru and its IT provider over a “Password1” account: what Cyber Essentials requires

What two Information Commission’s Office reprimands over a forgotten test account show about managing user accounts when someone else runs your IT, and what the Cyber Essentials password requirements ask of both sides.

By Jonathan Krause | Founder, Forensic Control | 21 October 2026

On 20 October 2026 the Information Commission’s Office (ICO) published reprimands to Data Cymru, the Welsh local government data company, and to Ogi Networks, the IT provider that had supplied its servers, connectivity and support since 2012. An attacker entered Data Cymru’s network through a test account created in 2012 with the password “Password1”, and the two reprimands read as a worked example of the controls behind the Cyber Essentials password requirements.

Personal data relating to 3,300 people, most of them children, was taken. The finding I would draw attention to is that responsibility did not sit with one organisation alone, because many organisations have the same arrangement with their own IT provider.

What the ICO found

The reprimand to Ogi Networks records that the company created the account, called Test2, on 13 January 2012 to test user access before migrating real users, and that it was still there twelve and a half years later, either active throughout or reactivated by mistake. A password strength tool rated “Password1” very weak and crackable in under a second.

The account was probably taken over by password spraying, where an attacker tries one common password against many accounts, with initial access apparently through the secure sockets layer virtual private network (SSL VPN) that Test2 was allowed to use. Responders found activity on the account from 20 September 2024, about six weeks before ransomware was deployed on 1 November.

The local administrator accounts on the domain controller (the server that manages logins across the network), a file server and a database server all shared one password, unchanged since January 2012, so credentials taken from one machine worked on the others. Before encrypting 182.7 gigabytes (GB) of data, the attacker copied 42GB out of the network.

Why both organisations were reprimanded

Data Cymru kept overall control of its network, and Ogi could only create or remove accounts on its instruction, which the ICO found left a gap in account auditing between the two. Ogi had no procedure for reviewing accounts in Data Cymru’s Active Directory, the Microsoft directory that holds a network’s user accounts. Data Cymru’s own reviews were not scheduled and covered only the Domain Users group rather than the full directory.

The reprimand to Data Cymru records that its agreement with Ogi was a 2016 order form that did not say how the account management service would be delivered, monitored or audited, and lacked the terms a sub-processor contract needs under Article 28 of the UK General Data Protection Regulation (UK GDPR). The ICO considered this directly contributed to the incident.

The detail I would point any IT manager towards is the password policy. Data Cymru enforced a 15-character password through Group Policy, but Test2 predated it and, as it was never used to log in, was never prompted to change its password. Ogi’s own policy followed National Cyber Security Centre (NCSC) guidance but covered only Ogi’s own accounts, so neither policy reached the account used to get in.

Neither organisation disputed the findings, and both have since put multi-factor authentication (MFA) on remote access, introduced regular account reviews and signed a compliant contract.

What the Cyber Essentials password requirements say

Both reprimands cite the Cyber Essentials requirements to remove unnecessary accounts and change default or guessable passwords as guidance available before the attack. The ICO referred to version 3.1, and the same controls sit in the current version 3.3, published in April 2026, under user access control, one of the five Cyber Essentials controls.

Under version 3.3, accounts must be removed or disabled when no longer required. Passwords must be protected against guessing by MFA, by throttling to no more than 10 guesses in 5 minutes, or by lockout after no more than 10 failed attempts, and must meet a quality control: MFA, at least 12 characters, or at least 8 with automatic blocking of common passwords. Throttling and lockout slow an attacker hammering one account, but password spraying tries one password once across many, which is why the quality controls and MFA matter most here.

An unused account with “Password1” on it would fail both requirements at assessment. The reprimands do not say whether either organisation held Cyber Essentials, and certification checks the controls in place at the time; it does not tell you what happens to a forgotten account over the following twelve months.

For an outsourced arrangement the important part is scope. Version 3.3 says every account an organisation owns is in scope even when a third party uses it, and where services are managed externally the organisation must be able to confirm the technical controls are being met. I covered the same principle from a different direction in a certificate covers a scope, not an organisation.

How to check your own accounts

I would start with an export of every account in the directory, enabled and disabled, since Data Cymru accepted afterwards that it should have reviewed the full contents of Active Directory. For each account, pull the last sign-in date and the date the password was last set. Any account whose password predates your current password policy has never been held to it, which was Test2’s position.

Next, list everyone allowed to use remote access, confirm each still needs it, and check that MFA is enforced on the remote access service itself. Then check that each machine’s local administrator account has its own password. The joint review after the attack took just over four hours and found eight unused accounts.

The last check is the contract with your IT provider. If it does not say who reviews accounts, how often, and who signs off removals, that is worth agreeing in writing, and a provider handling personal data on your behalf also needs the Article 28 terms. If I were raising it, I would ask the provider for every account they have created on the network and when each was last used.

What it means for IT providers and supplier checks

Last month I wrote about running a Cyber Essentials supplier check, which asks whether the businesses you buy from are certified. This case sits on the other side: a supplier’s certificate describes the supplier’s own systems, whereas the accounts an IT provider creates inside your network sit in your scope.

From the provider’s side, each client now has to be able to show an assessor that the accounts you manage meet the controls, and the most useful thing you can hand them is a dated list of every account you have created, with last sign-in and password dates. Remote monitoring and management tools often report much of this already, and we have set out how that reporting maps to the controls for managed service providers and IT providers.

If you are renewing Cyber Essentials in the next few months, the account review is worth doing before the assessment rather than during it.