Password1 for 12 Years: What the ICO Reprimand Teaches About Old Accounts and Retired Kit

A test account created in January 2012 with the password "Password1" was still in place when ransomware hit a Welsh public sector data unit in November 2024. The Information Commissioner's Office announced reprimands on 20 October 2026. Nothing in the case is about disposing of IT equipment, but the lesson is the same one that applies every time a system is retired: the accounts outlive the hardware unless somebody removes them.

This piece sets out what the regulator found, what it did not say, and how its six lessons translate into a checklist for decommissioning servers, firewalls and other kit.

What the ICO found

The ICO's announcement says it issued reprimands to Ogi Networks Limited (ONL) and the Local Government Data Unit, Wales, known as Data Cymru. The attack took place on 1 November 2024. It encrypted 182.7GB of data, and 42GB was taken from Data Cymru's systems. The personal information of 3,300 people was taken, the majority of whom were children. The compromised information related to two projects supporting children and families.

The attack exploited a test account, "Test2", that "had existed for more than 12 years". The ICO says it had either remained active since it was created or been inadvertently reactivated before the incident. Throughout that period it was protected by the password "Password1", which a third-party password strength tool classed as "very weak" and said could be compromised in less than a second.

The findings split between the two organisations:

• ONL created the account in January 2012 without appropriate password-strength requirements, did not regularly audit the accounts it had created in Data Cymru's network, and did not review local administrator accounts after deployment, so accounts on three affected systems kept the same password for more than 12 years. The ICO found infringements of Articles 32(1)(b) and 32(1)(d) of the UK GDPR.
• Data Cymru did not have a contract with ONL containing the mandated data protection terms for a sub-processor, did not clearly document how the directory services would be delivered, monitored or audited, failed to ensure the dormant account was found and removed or updated, and ran account reviews that were not routine and did not cover the whole directory. The ICO found infringements of Articles 28(4), 32(1)(b) and 32(1)(d).

The ICO was explicit that responsibility "did not sit with one organisation alone". ONL created the account, but Data Cymru kept overall control of its network, including the ability to tell ONL to create or remove accounts. After the incident the two signed a compliant data processing contract on 30 April 2025 and introduced periodic account reviews and multi-factor authentication. The announcement reports reprimands and does not mention a fine.

What the case does not say

It is not a disposal case. The announcement does not say that any equipment was retired or that the account related to a decommissioned system. The announcement also does not describe how the attacker reached the account. What follows is our reading of how the regulator's lessons apply to retired IT, and it is flagged as such.

One note on names: since 30 September 2026 the Data (Use and Access) Act has transferred the Commissioner's powers to a new Information Commission, which acts through the Information Commission's Office. We say ICO for short, as the announcement's own web address does.

Why retired kit leaves accounts behind

When a server, firewall or room device is retired, the physical object goes to disposal. The credentials it used, the accounts it served and the passwords shared between systems often stay behind in the directory, in a password sheet or in a supplier's records. Three details in this case are the kind of thing a system retirement can leave behind:

• An account created by a supplier during set-up work, then never reviewed.
• The same local administrator password on three systems for more than 12 years.
• Reviews that checked a subset of accounts, not the whole directory.

Our article on retiring routers, firewalls and switches makes the same point for network kit: wiping the device does not rotate the credentials it knew.

The ICO's six lessons, applied to decommissioning

The ICO lists six lessons for organisations. Each one reads naturally as a step in a decommissioning plan. The lesson headings are the ICO's. The decommissioning application is ours.

1. Remove accounts that are no longer required. The ICO says test, dormant and former-user accounts should be routinely identified and deactivated. Before a system leaves, list every account that existed for it: service accounts, admin accounts, vendor and test accounts. Disable and then delete them.
2. Block weak and commonly used passwords. Password controls should stop "Password1" being used. For anything that stays in service after the retirement, check that the policy blocks common passwords.
3. Protect remote access. The ICO says multi-factor authentication should be applied to remote access services by default. Remove or tighten any remote access that existed only to manage the retired system.
4. Audit the whole account environment. Reviews should cover all relevant accounts, permissions and security groups, not a limited subset. After a retirement, review groups and permissions that referred to the old system.
5. Avoid shared administrative credentials. Privileged accounts should use unique credentials so one compromised system does not open the others. If the retired system shared an administrator password with live systems, change it on the live ones.
6. Define responsibilities in contracts. The ICO says agreements with IT providers and sub-processors should explain how security controls will be delivered, monitored and audited, and include the mandated terms. That includes your disposal supplier, which handles your devices and the data on them. We set out the questions to ask in our article on supplier assurance.

A short test before the van arrives

Before a retired system is collected, you should be able to answer yes to each of these:

• Do we have a list of every account the system used or served, including ones a supplier created?
• Have those accounts been disabled and then removed?
• Has any password the system shared with a live system been changed?
• Has someone checked the whole directory, not a sample?
• Does the contract with whoever handles the device say who is responsible for what?

If the system is a meeting-room device, the same applies to the room account it signed in with, as we cover in our article on retired meeting-room screens. For a whole-floor clear-out, our guide to office IT clearance gives the order of work.

The honest summary

The ICO's finding is plain: a weak password on an account nobody needed, in a system where nobody was sure who was responsible, led to a ransomware attack affecting 3,300 people. The case is not about disposal, but the discipline it asks for is the discipline of decommissioning. List the accounts, remove the ones you no longer need, change shared passwords, check the whole directory and write the responsibilities down.