MeanCEO: Tech Startups and Startup Ideas

Ogi Networks Data Breach: How a 12-Year-Old "Password1" Test Account Let Ransomware In, and Why the ICO Blamed the Client Too

TL;DR: What is the Ogi Networks data breach?

On 20 October 2026, the UK data protection regulator reprimanded Ogi Networks Limited, a Welsh broadband and IT provider, and Data Cymru, the Welsh local government data unit, over a ransomware attack on 1 November 2024. The attackers got in through a test account called "Test2" that Ogi created in January 2012 with the password "Password1". Nobody removed it for more than 12 years. Data on about 3,300 people, most of them children, was exposed. There was no fine. The lesson for founders: old accounts and supplier logins are your problem too, and one hour of account cleanup closes the same door.

The Ogi Networks data breach is why "Ogi Networks Limited data breach" jumped more than 800% on Google Trends in the UK on 21 October. The headline writes itself, because the password really was "Password1". The part that matters for your startup is less funny: the regulator blamed both the IT supplier who created the account and the client who never checked its own user list.

Here is what the regulator found, why both companies were reprimanded, and the account audit I'd run in every startup this week.

What happened in the Ogi Networks data breach?

The regulator's press release of 20 October 2026 sets out the facts:

On 1 November 2024, a ransomware attack hit Data Cymru, which handles data for Welsh local government. The attackers encrypted 182.7GB of data and took 42GB from Data Cymru's systems.
The stolen personal data covered about 3,300 people, the majority of them children, from two projects supporting children and families.
The way in was "Test2", a test account Ogi Networks created in January 2012 with the password "Password1".
The account had existed for more than 12 years. It had either stayed active the whole time or been reactivated by mistake before the attack.
A third-party password checker rated "Password1" as very weak, crackable "in less than a second".

Ogi provided Data Cymru's Active Directory services. Active Directory is Microsoft's central list of user accounts and permissions on a Windows network, so whoever holds an account there can log in to the systems it covers. In data protection terms, Ogi was Data Cymru's sub-processor: a supplier that handles personal data on behalf of an organisation that itself handles it for others.

According to the Pembrokeshire Herald, a December 2025 report to Isle of Anglesey County Council described the data as information about children in care placements across Wales going back to 2012, including names, dates of birth, placement details and addresses of care settings.

Why did the ICO reprimand both Ogi Networks and Data Cymru?

Because each one could have closed the door, and neither did. David Doodson, Head of Investigations at the regulator, put it plainly: "The responsibility for these failures did not sit with one organisation alone."

Organisation	UK GDPR articles breached	What the regulator found
Ogi Networks Limited (the IT supplier)	32(1)(b), 32(1)(d)	No password-strength rules on the account; no regular audit of accounts it created in the client's network; local admin passwords on three affected systems unchanged for more than 12 years
Data Cymru (the client)	28(4), 32(1)(b), 32(1)(d)	No contract with Ogi containing the data protection terms the law requires; no documented way to monitor Ogi's Active Directory service; account reviews that were neither scheduled nor complete

Article 32 of the UK GDPR (General Data Protection Regulation) requires security that fits the risk, plus a process to test it regularly. Article 28(4) says that when a processor brings in another supplier, the same data protection duties have to be written into a contract. The regulator also noted that the account survived "over six years after ONL's obligations under the GDPR came into effect", which counts from May 2018.

The detail founders should remember: Ogi created the account, and Data Cymru "retained overall control of its network, including the ability to instruct ONL to create or remove accounts". Outsourcing your IT moved the work to a supplier, and the accountability stayed with the client.

Was Ogi Networks fined?

No. The outcome was two formal reprimands, and the Herald reports that the regulator announced no financial penalty against either organisation. A reprimand is a public, on-the-record finding that an organisation broke data protection law. It carries no fine, and for an IT supplier the damage to trust is the real cost.

Both organisations have fixed things since. According to the regulator, Ogi now prompts customers to review their accounts regularly and has strengthened access controls with multi-factor authentication (MFA), the second step after a password, such as a code from an app. Data Cymru added regular account reviews and MFA, and the two signed a legally compliant data processing contract on 30 April 2025. In a statement reported by The Independent, Ogi accepted the findings, said the test account should have been deleted long before, and said the incident was confined to a server it hosted for Data Cymru, with other customers unaffected.

One more detail explains the odd name in the press release. Since 30 September 2026, under the Data (Use and Access) Act 2025, the Information Commissioner's role has passed to a new Information Commission, and the "ICO" now stands for the Information Commission's Office. The regulator is the same, under a new structure.

What does the Ogi Networks data breach mean for your startup?

Every startup I know has its own "Test2": a demo login from the first investor pitch, a contractor's admin account from 2023, a shared "admin@" mailbox that five people know the password to. Each one looks harmless on a Tuesday and works as an open door on the day someone tries it. Here's the audit I'd run this week:

Export your user lists. Pull every account from Google Workspace or Microsoft 365, your cloud provider (AWS, Google Cloud, Azure), your code host, your CRM and your website admin. It takes about twenty minutes.
Delete test, demo and temporary accounts. If nobody can say who uses an account, disable it today and delete it in a week if nobody complains.
Remove everyone who left. Former employees, interns, agencies and freelancers. Rotate any password or API key they knew.
Turn on MFA for remote access, by default. The regulator lists it first among its recommendations. Email, VPN, cloud consoles and admin panels come first.
Block weak and common passwords. Google Workspace and Microsoft 365 both let admins enforce password rules. A password manager for the team makes long passwords painless.
End shared admin logins. Each admin gets a named account, so you can see who did what and remove one person without changing everything.
Ask your suppliers what they created. Your IT provider, web agency and freelancers have made accounts in your systems. Ask for the list in writing.
Write security into supplier contracts. Under UK and EU GDPR, a supplier who handles personal data for you needs a contract with data protection terms. Ogi's client was reprimanded for missing exactly that.

If you're bootstrapping in Europe, the same GDPR Articles 28 and 32 apply to you as they did to a Welsh public body. Start with our GDPR compliance checklist for early-stage startups, and use the step-by-step GDPR guide for the contracts part.

Security works best as a habit built in early. Our guide on how to build security into startup operations from day one covers the routines, and vendor management for lean startup teams shows how to keep track of every supplier who touches your data.

Are you getting customers from ChatGPT yet?

More and more traffic is coming from Perplexity, ChatGPT, Grok and other AI tools.

👉 Rank on ChatGPT

What do the other October security stories have in common?

Old access is the thread. This week's PHP vulnerability emergency patch hit sites that nobody had updated in years, and the OpenCode breach exposed saved API keys that users had long forgotten about. The Ogi case adds the human version: a login someone made for a quick test in 2012.

Small teams carry the most risk, because nobody owns this job by default. Put the account review on the calendar next to your back-office stack review, once a quarter. And for a monthly roundup of attacks and fixes, read our cybersecurity news for October 2026.

If you run a small business and outsource your IT, the Fe/male Switch Foundation explains what to put in your contract with your IT provider, with an email you can send them this week. If you're the freelancer creating accounts in client systems, femaleswitch.com has an access handover checklist for freelancers.

FAQ: the Ogi Networks data breach

What is the Ogi Networks data breach?

A ransomware attack on 1 November 2024 hit Data Cymru, which used Ogi Networks Limited as its IT supplier. Attackers used a test account called Test2, created by Ogi in January 2012 with the password Password1, and took 42GB of data about roughly 3,300 people, mostly children. The UK regulator reprimanded both organisations on 20 October 2026.

Was Ogi Networks fined by the ICO?

No. The regulator issued formal reprimands to Ogi Networks Limited and Data Cymru, and no financial penalty was announced against either organisation.

What did the ICO say Ogi Networks did wrong?

It found breaches of UK GDPR Articles 32(1)(b) and 32(1)(d): no password-strength rules on the account, no regular audit of the accounts Ogi created in Data Cymru's network, and local admin passwords on three systems left unchanged for more than 12 years.

Why was Data Cymru reprimanded if Ogi created the account?

Data Cymru kept overall control of its network and could tell Ogi to remove accounts. The regulator found it had no contract with the data protection terms required for a sub-processor under Article 28(4), and its account reviews were not routine or complete.

Were Ogi's other customers affected?

Ogi said, in a statement reported by The Independent, that the incident was confined to a server it hosted for Data Cymru and that other customers' information was not affected.

How can a startup avoid a Password1 breach?

Export all user accounts, delete test and old accounts, turn on multi-factor authentication for remote access, block common passwords, stop shared admin logins, and put security duties in every supplier contract. Repeat the review every quarter.

About the Author

Violetta Bonenkamp, also known as MeanCEO, is an experienced startup founder with an impressive educational background including an MBA and four other higher education degrees. She has over 20 years of work experience across multiple countries, including 5 years as a solopreneur and serial entrepreneur. Throughout her startup experience she has applied for multiple startup grants at the EU level, in the Netherlands and Malta, and her startups received quite a few of those. She’s been living, studying and working in many countries around the globe and her extensive multicultural experience has influenced her immensely.

Violetta Bonenkamp

2026-10-21 22:22 News and Trends