Telecoms provider Ogi reprimanded after cyber-attack exposed children’s info.

Telecoms and IT provider Ogi Networks Limited, which is closely linked altnet Ogi who recently deployed a full fibre (FTTP) broadband network to cover more than 118,000 premises across South Wales (inc. a small part of England), has been “reprimanded” by the UK’s Information Commissioner’s Office (ICO) after a cyber-attack exposed children’s information.

Just to be clear. A reprimand by the ICO reflects an official notice of law infringement (data protection), which sits a step above an informal warning. But crucially such violations aren’t typically considered serious enough to attract a financial penalty (fine) or strict enforcement notice.

According to the reprimand notice, Ogi (ONL) had long provided managed IT services to the Local Government Data Unit in Wales (Data Cymru). Data Cymru in turn offers a range of specialist services (e.g. Wi-Fi, licensing services for MS Office 365/anti-virus, managed backup and IT support etc.) designed to help local councils and other organisations to find, collect, analyse and present data effectively.

Sadly, Data Cymru experienced a ransomware attack on 1st November 2024, which involved the attacker utilising a test account called “Test2” to infiltrate their network and encrypt 182.7GB of data held on a file server and an internet database (SQL). Before deploying the ransomware, the attacker also stole 42GB of data. In a separate, but linked investigation, Data Cymru confirmed that personal data relating to 3,300 subjects (mostly children) was also taken in the incident.

Ogi informed the ICO that it created the “Test2” account all the way back in 2012 as part of its original project for Data Cymru (likely intended to test user account access before migrating real users). As if to make matters much worse, it gave that account the password of “Password1” (very easy to hack!), which was used across multiple systems.

The ICO also identified suspicious activity involving the “Test2” account as early as 20th September 2024, more than a month before the ransomware attack. Ogi later confirmed that it had never conducted reviews of these local administrator accounts following their initial deployment. Likewise, no joint auditing process was conducted to identify accounts that were no longer required.

The ICO ultimately determined that Ogi’s infringements began on 25th May 2018, when GDPR obligations came into force, and continued until October 2025, when Ogi implemented a revised approach to reviewing user accounts. “The seriousness of the Infringements is compounded by the fact that the failure to implement appropriate technical and organisational security measures persisted for 6.5 years and went undetected,” said the ICO.

A spokesperson for Ogi Networks Limited told ISPreview:

“We provided IT services to Data Cymru, and a test account set up on its network in 2012 should have been removed long before criminals were able to use it. We accept the Information Commission’s findings, and we’ve acted on them.

Within a week of the attack, we’d worked with Data Cymru to check every account on its network and switched off the ones it no longer needed that same day. We also brought in independent cyber security specialists to investigate. Since then, we’ve protected remote access with multi-factor authentication and introduced regular account reviews for the customers whose networks we look after, so accounts that aren’t needed are found and removed.

This was limited to the server we hosted for Data Cymru. No other customer information held by ONL was affected.”

Interestingly, the ICO confirmed that it had received no complaints about Ogi relating to the incident. However, it specifically cautioned that the absence of complaints did not mean the infringements were less serious. “Taking into account the circumstances of this case, including the remedial steps ONL has implemented after the Incident and steps taken to mitigate the damage to data subjects, the Commission has decided to issue this Reprimand to ONL,” said the ICO.

Just to clarify that the ICO’s reprimand is directed at Ogi, not Data Cymru. It concerns Ogi’s failure to implement appropriate security measures in its role as a sub-processor. The document also mentions a separate, linked investigation concerning Data Cymru, which can be found here. This also reprimands Data Cymru, but puts no onus on one company – identifying the joint lack of governance to support the creation (and removal) of user accounts.