Your IT provider made the account. You both got the reprimand.

· · Security

Somewhere in your Microsoft 365 or your office network there is probably an account nobody remembers creating. Your IT provider set it up years ago to test something during a migration, or to give an engineer a way in, and then the project finished and everyone moved on. The account did not.

If that account is ever used to break in, whose problem is it? Yours, or the IT company that made it? The Information Commissioner's Office has just answered that question, and the answer is both.

On 20 October the ICO reprimanded two Welsh organisations over a ransomware attack: Data Cymru, the body that helps Welsh councils and public services use data, and Ogi Networks (ONL in the ICO's documents), the IT provider that has run its servers and accounts since 2012.

A test account called Test2

In January 2012, during its first project for Data Cymru, Ogi created an account called "Test2" to check that logins worked before moving real users across. It was given the password "Password1". The project ended. The account stayed, still active and still on that password, for more than 12 years.

In November 2024 an attacker used it to get in. The local administrator accounts on the three affected servers all shared the same password, so once the attacker was inside one machine, they could use it to reach the others. They took 42 GB of data before encrypting 182.7 GB of files and databases. The stolen data came from two projects supporting children and families, and covered 3,300 people, most of them children.

None of this needed a clever attacker. It needed an old account, a password that a common strength checker rates as crackable in under a second, and nobody looking.

Why the client got reprimanded too

The tempting reading is that the IT company messed up and the client was unlucky. The ICO did not see it that way.

Ogi was reprimanded for the obvious things: creating the account with a weak password, never auditing the accounts it had made, and never reviewing the shared administrator passwords after setting them up.

Data Cymru was reprimanded separately, and its list is the one worth reading if you buy in IT support:

  • No proper contract. Data protection law requires specific terms in any contract with a supplier that handles personal data on your behalf. Data Cymru did not have them in place with Ogi.
  • Nobody had written down who did what. There was no clear record of how the account management Ogi provided would be delivered, monitored, or checked. Each side could reasonably assume the other was looking after it.
  • Its own account reviews were patchy. They happened, but not on a schedule, and did not cover every account.
  • It tightened its password rules but never applied them to the old account. The new rules covered new passwords. Test2 sat outside them for years.

The ICO's head of investigations, David Doodson, put the reasoning plainly: "The responsibility for these failures did not sit with one organisation alone. ONL created the test account whilst Data Cymru retained overall control of its network, including the ability to instruct ONL to create or remove accounts."

That is the sentence to take away. Outsourcing your IT moves the work. It does not move the accountability. If you can tell your provider to delete an account, the regulator expects you to know whether it should exist.

Neither organisation was fined. The ICO pointed to what both did afterwards: two-step verification, regular account reviews, and a data processing contract that was finally signed in April 2025, five months after the attack.

What to do this quarter

Ask your IT provider for a list of every account in your systems, not just the ones with staff names. That means test accounts, service accounts, shared logins, former employees, and anything the provider uses to get in. For each one, ask what it is for and who asked for it. Anything nobody can explain should be switched off. If it breaks something, you will find out quickly and can turn it back on.

Make account reviews a scheduled job with a named owner. Once a quarter is plenty for most small businesses. Agree whether you or the provider does it, and get it written down. The Data Cymru gap was that each side thought the other had it covered.

Check that your password rules reach the old accounts. Raising your password standard only protects new passwords. Ask whether existing accounts were made to comply, and whether common passwords like Password1 are blocked outright. Microsoft 365 does this automatically for cloud accounts. Accounts on your own servers need it switched on separately, and your provider should know how.

Stop sharing one administrator password across machines. If every computer's local admin account uses the same password, breaking into one breaks into all of them. Microsoft's free Local Administrator Password Solution, now built into Windows, gives each machine its own password and changes it automatically. Ask your provider whether it is switched on.

Turn on two-step verification for anything reachable from outside. That means a code from an app or a text as well as the password. It is the control that would have made Password1 nearly useless on its own, and it is a basic requirement of Cyber Essentials.

Find your contract with your IT provider and read the data protection section. If your provider can see your customers' or staff's personal data, UK GDPR requires the contract to say what they may do with it and how they will keep it secure. If there is no such section, or no contract at all, ask for one. Most decent providers have a standard data processing agreement ready to send.

None of this is expensive. It is a list, a calendar reminder, and a contract that should already exist.

How Steelwise can help

Working out which accounts exist in your systems, who is responsible for each one, and whether your contract with your IT provider says what the law needs it to say is a short, well-defined review. Get in touch if you would like a second pair of eyes on it.

Further reading

← All filings

We use cookies to understand how visitors use this site. More information.