> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Weak test account credentials enable ransomware attack on Welsh data unit - URL: https://f4n6.co.uk/security-feed/weak-test-account-credentials-enable-ransomware-attack-on-welsh-data-unit/ - Published: 2026-10-20T21:19:37.000Z - Updated: 2026-10-20T21:19:37.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary On 1 November 2024 an intruder used a dormant test account, Test2, protected by the password "Password1" to enter the network of the Local Government Data Unit โ€“ Wales (Data Cymru) and deploy ransomware that encrypted 182.7 GB across a file server and an internal database server. The actor exfiltrated 42 GB from a primary domain controller, a file server and an SQL server before encrypting. The UK Information Commissioner's Office (ICO) reprimanded both Data Cymru and its infrastructure provider Ogi Networks Limited (ONL) under Article 32 of the UK GDPR, finding that the Test2 account had remained active with its original 2012 password for more than 12.5 years and that local administrator accounts on all three impacted systems shared one password. No CVE, CVSS score, EPSS estimate or CISA KEV entry is associated with this item; the compromise turned on credential and account-lifecycle failures, not a software vulnerability. For EMEA financial services the transferable risk is orphaned and shared-credential accounts in managed or outsourced estates, where a single forgotten local administrator password gives an intruder domain-wide lateral movement. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28: ICT third-party risk, general principles | ONL, a third-party provider, created and retained the Test2 account and the shared local administrator passwords on Data Cymru's systems, and neither party had measures to identify and remove old accounts. | Firms must be able to show contractual and operational oversight of accounts a provider creates or holds in the client's estate, including who can instruct creation and removal. | | DORA Art. 30: key contractual provisions with ICT third-party providers | Responsibility for the failed account was split between ONL (created the account) and Data Cymru (held network control and the ability to instruct removal), and neither had clear measures. | Provider contracts need explicit allocation of account-lifecycle and credential-management duties, with audit rights and removal obligations. | | NIS2 Art. 21(2)(d): supply chain security measures | The intrusion reached Data Cymru through a provider-managed account, and the ICO found the security failure spanned both organisations. | Supply chain security measures must cover provider-held credentials and privileged accounts, not only provider software and connectivity. | ## 3\. Technical analysis & attack chain The confirmed sequence, as set out in the ICO reprimands: 1. ONL created the account Test2 on 13 January 2012 during its initial project for Data Cymru, to test user account access before migrating real users to its services. It was given the password "Password1". 2. The account was never reviewed. ONL confirmed it carried out no reviews of local administrator accounts after initial deployment, so Test2 stayed active regardless of use. 3. On 1 November 2024 an intruder used Test2 to enter the Data Cymru network. 4. The actor exfiltrated 42 GB of data from a primary domain controller, a file server and an SQL server. 5. The actor deployed ransomware that encrypted 182.7 GB of data on a file server and an internal database server. 6. Personal data relating to 3,300 people, mostly children, was affected. The lateral-movement mechanism is the part that matters most for defenders. The local administrator accounts on the three impacted systems all used the same password. Once one system was breached, the local account hashes could be collected and reused to authenticate to other systems on the Data Cymru network. This is pass-the-hash style reuse of a shared local credential, and it converts a single foothold into access to the domain controller, file server and SQL server that the actor then mined for data. The ICO cited Bitwarden's password strength tool, which rated "Password1" as very weak with an estimated cracking time under a second. The regulator also found ONL had no auditing procedures to review user accounts within Data Cymru's Active Directory, and that Data Cymru retained overall control of its network, including the ability to instruct ONL to create or remove accounts. The reporting does not name the ransomware family, the intrusion tooling, the command-and-control infrastructure, any malware hash, or the initial-access technique beyond use of the Test2 credential. It does not state whether the actor authenticated interactively or reused a hash for Test2\. Those gaps are in the source, not omitted here. The account name, password and data volumes are single-sourced to The Register's account of the ICO reprimands; the underlying reprimand PDFs are the authoritative record and should be read before any control decision rests on a specific figure. ## 4\. Mitigation & containment P1 within 24 hours - Inventory every account in Active Directory and connected systems that was created by or for a third-party provider, and disable any that no current owner can justify. Test2 is the pattern: a project account from 2012 still enabled in 2024. - Find local administrator accounts that share a password across hosts. On Windows, compare the local SAM credential material across servers; where the same local admin password is reused, rotate it to a unique value per host and move to Windows LAPS so the password is managed and rotated automatically. - Reset any account still using a default or project-era password, and check for accounts whose password has not changed since onboarding. P2 within 72 hours - Establish a recurring account recertification process with a named owner per account and a maximum age, and record the review. The ICO's finding against ONL was the absence of any review after initial deployment. - Put account creation and removal for provider-managed systems under a documented instruction path, so Data Cymru-style network owners can compel removal. This is the control the ICO found missing on both sides. - Enable auditing of account changes and privileged logons in Active Directory and forward the logs to a monitored sink, closing the "no auditing procedures" gap the ICO identified. P3 within 7 days - Add detection for authentication with dormant or service accounts and for local-account logons across multiple hosts from one credential (see ยง6). - Review backup and restore coverage for file and SQL servers, since the impact here was encryption of 182.7 GB on exactly those systems, and confirm restore has been tested. ## 5\. Indicators of compromise No atomic indicators (hashes, domains, IPs, filenames) are present in the source. The source describes behaviours only. | Behaviour | Where to observe | Confidence | | --------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- | ----------------------------------------------------- | | Authentication using the account name Test2 | Active Directory and Windows Security event logs (4624, 4625) | High, account name is stated in the source | | Successful logon to a dormant account created in 2012 with no recent activity | Domain controller security logs, account last-logon attributes | Medium, inferred from the described account lifecycle | | Reuse of one local administrator credential across multiple hosts | Security log 4624 type 3/10 with local accounts across hosts, credential material comparison | Medium, mechanism described by the ICO | | Bulk data access from a domain controller, file server and SQL server before encryption | File server access logs, SQL audit logs, DC replication and access events | Medium, activity described but no log detail given | | Mass file encryption on a file server and internal database server | File system auditing, EDR file-modification telemetry | Medium, impact described but no artefact given | No copyable atomic indicator block is provided because the source contains no machine-pivotable indicators. ## 6\. Detection The source gives no malware strings, filenames, hashes or command lines, so a YARA rule cannot be built from genuine artefacts. The account name Test2 is a real artefact and supports a Sigma rule for authentication with that account and for shared local-admin reuse. ```yaml title: Authentication with dormant test account Test2 id: 8f2c1a4e-6b7d-4c9e-9a10-3d5e7f0b2c61 status: experimental description: Detects logon attempts using the legacy test account Test2, which was used to breach Data Cymru in November 2024. author: Adverse Trace date: 2026-10-20 references: - https://www.theregister.com/cyber-crime/2026/10/20/password1-and-a-forgotten-test-account-land-welsh-outfits-in-hot-water/5304139 logsource: product: windows service: security detection: selection: EventID: - 4624 - 4625 TargetUserName: 'Test2' condition: selection falsepositives: - A legitimate account genuinely named Test2 in a non-production environment level: high ``` ```yaml title: Local administrator account logon across multiple hosts id: 2b9d7c30-1e4a-4f88-b6c2-7a0d9e5f3b14 status: experimental description: Flags logons by local administrator accounts to multiple distinct hosts, consistent with reuse of a shared local admin password as seen in the Data Cymru intrusion. author: Adverse Trace date: 2026-10-20 references: - https://www.theregister.com/cyber-crime/2026/10/20/password1-and-a-forgotten-test-account-land-welsh-outfits-in-hot-water/5304139 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: - 3 - 10 filter_machine_account: TargetUserName|endswith: '$' condition: selection and not filter_machine_account timeframe: 1h falsepositives: - Legitimate administrative tooling that authenticates to many hosts with one managed account level: medium ``` The second rule needs correlation across hosts to be useful; a single-host SIEM will not see the pattern. Tune the timeframe to the estate size. ## 7\. Sources - The Register, "'Password1' and a forgotten test account land Welsh outfits in hot water", https://www.theregister.com/cyber-crime/2026/10/20/password1-and-a-forgotten-test-account-land-welsh-outfits-in-hot-water/5304139, 20 October 2026\. Single source for all facts in this advisory; it reports the ICO reprimands of ONL and Data Cymru, whose PDFs are referenced by the article but not reproduced here. ## 8\. Adverse Trace position Adverse Trace assesses this as a credential and account-lifecycle failure rather than a software vulnerability: no CVE, CVSS score, EPSS estimate or CISA KEV entry applies, and the severity is set by the shared local administrator password and a 12.5-year-old test account, not by any exploit. The client impact is indirect but real for firms that outsource infrastructure or hold provider-created accounts in their own directory, because the same pattern (a forgotten account plus one reused local admin password) gives an intruder domain-wide reach and a clean path to the domain controller, file server and SQL server. All facts here rest on a single source, The Register's account of the ICO reprimands, so we treat the specific figures and account details as single-sourced and will read the two ICO reprimand PDFs to confirm them before any client relies on a number. We will next map this pattern onto client third-party estates, checking for provider-created accounts and shared local administrator passwords, and will issue an updated note if the reprimands add technical detail the article omits. --- [Read the original source โ†’](https://www.theregister.com/cyber-crime/2026/10/20/password1-and-a-forgotten-test-account-land-welsh-outfits-in-hot-water/5304139?ref=f4n6.co.uk) *Published via PulseTrace โ€” Adverse Trace threat intelligence.*