Data Cymru has been reprimanded by a regulator after a ransomware attack exposed the personal information of 3,300 people.
The Information Commissioner's Office (ICO) found the November 2024 attack exploited a test account that was protected by the password ‘Password1'.
Head of investigations at the ICO, David Doodson, said Password1 was a ‘wide-open door to nefarious actors', adding: ‘This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber attack that can affect thousands.'
Data Cymru, which is used by Wales' 22 local authorities, has since added multi-factor authentication.
