'Password1' and a forgotten test account land Welsh outfits in hot water
A test account protected by "Password1" helped an intruder steal personal data relating to 3,300 people, mostly children, in a ransomware attack that has drawn regulatory rebukes for two Welsh organizations.
The Information Commission's Office (ICO) issued reprimands rather than fines to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, also known as Data Cymru.
According to the ICO, altnet ONL provided server and connectivity infrastructure, licensing, and support to Data Cymru, which helps public bodies across Wales make effective use of data.
On November 1, 2024, Data Cymru suffered a ransomware attack after a miscreant exploited a test account called Test2 to infiltrate its network and encrypt 182.7 GB of data housed in a file server and an internal database server.
"Before deploying the ransomware, the threat actor exfiltrated 42 GB of data from a primary domain controller, a file server and an SQL server," the ICO said on Tuesday in its reprimand of ONL …
You're reading a preview. The full article is published by The Register on their website.
Read the full story on The Register
