One password. Twelve years. 3,300 people's personal data exposed.
In October 2026, the Information Commissioner’s Office (ICO) reprimanded two Welsh organisations after a ransomware attack exposed data belonging to thousands of people, most of them children. The attackers didn’t need a sophisticated exploit. They got in through a forgotten test account protected by the password “Password1”.
It’s easy to read a story like this and think it couldn’t happen to you. But the real failure here wasn’t technical. It was a data governance failure: nobody owned the account, nobody checked it, and nobody was clear on who was responsible.
In this blog, we look at what went wrong, why data governance matters for every SME, and the simple steps you can take to make sure your business isn’t next.
What happened in the Password1 breach?
On 1 November 2024, attackers launched a ransomware attack on the systems of Data Cymru, a Welsh public sector data organisation (now part of the Welsh Local Government Association), hosted by its outsourced IT provider, Ogi Networks Limited. According to the ICO, they encrypted 182.7GB of data and stole 42GB. The stolen data related to two projects supporting children and families.*
The ICO’s investigation found that:
- A test account created in 2012 had never been removed. Called “Test2”, it sat on the network for more than 12 years without being audited.
- It was protected by the password “Password1”. A password like this can be cracked in less than a second.
- Local administrator accounts were never reviewed. Accounts on three affected systems shared the same password for the same 12-year period.
- There was no data processing agreement between the organisation and its IT provider, leaving a gap in who was responsible for what.
Both organisations were found to have breached UK GDPR by failing to protect their systems properly and by not regularly testing whether their security measures worked**.
"This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands."
To their credit, both organisations have since introduced multi-factor authentication, regular account reviews and a compliant data processing contract. The organisation has also said there is no evidence the stolen data was shared further or misused.
Why this is a data governance problem,
not just an IT one
It’s tempting to file this under “bad password” and move on. But the password was only the symptom. The ICO itself said responsibility for the failures “did not sit with one organisation alone”.
Data governance is how a business decides who owns its data, who can access it, how it’s protected and how that protection is checked. When governance is weak, small gaps go unnoticed for years:
- No ownership. Nobody was responsible for the test account, so nobody removed it.
- No review. Accounts and passwords were set up once and never checked again.
- No clear accountability. Without a data processing agreement, neither organisation was clearly responsible for security and audits.
This is the pattern behind many SME data breaches. Systems keep working day to day, so nobody notices the risk building underneath until something goes wrong.
5 data governance basics every SME needs
Good data governance doesn’t need to be complicated. These five basics would have closed every gap the ICO identified.
1. Know what data you hold and where it lives
You can’t protect data you don’t know about. Map what personal and sensitive data your business holds, where it’s stored and who can access it. Most SMEs now use a mix of cloud tools and older systems, which makes this harder than it sounds. We cover this in more detail in our blog, “Is data security your top priority?“
2. Manage every account, from start to finish
Every account needs an owner and an end date. That includes staff, leavers, suppliers, admin accounts and test accounts. Build user access reviews into your joiners, movers and leavers process so accounts are removed the moment they’re no longer needed.
3. Enforce strong passwords and multi-factor authentication
A password policy only works if it’s enforced. Block weak and reused passwords, and use multi-factor authentication (MFA) on every account, especially remote access and admin accounts. With MFA, one stolen password isn’t enough to get in.
4. Put a data processing agreement in place with every supplier
UK GDPR requires a written contract whenever a supplier processes personal data on your behalf. A data processing agreement sets out who is responsible for security, audits and breach reporting. Without one, gaps in accountability are almost guaranteed.
5. Review and test regularly
Security isn’t “set and forget”. Schedule regular account audits, password reviews and security testing, and keep a record of them. If the ICO ever asks how you protect your data, you’ll be able to show them.
Outsourcing IT? 6 questions to ask your provider
Outsourcing your IT is one of the best ways for an SME to access expert support. But outsourcing the work doesn’t outsource your responsibility. Under UK GDPR, your business is still accountable for the personal data it holds.
Ask your IT provider:
- Do we have a signed data processing agreement, and what does it say you’re responsible for?
- How often do you review user, admin and test accounts on our network?
- Is multi-factor authentication switched on for all remote and admin access?
- How do you enforce password policies across our systems?
- When was our security last tested, and can we see the results?
- What happens, and who does what, if we suffer a data breach?
If any of these answers are unclear, that’s a gap worth closing now.
Data governance FAQs
What is data governance?
Data governance is the set of rules, responsibilities and processes that decide how a business manages its data. It covers who owns the data, who can access it, how it’s protected and how that protection is checked.
Why does data governance matter for SMEs?
SMEs hold the same kinds of personal data as larger organisations, but often with fewer resources to manage it. Weak data governance increases the risk of data breaches, ICO action and lost client trust.
What is a dormant account?
A dormant account is a user, admin or test account that is no longer used but still has access to your systems. Attackers target dormant accounts because nobody is watching them.
How often should you review user accounts?
Most businesses should review user and admin accounts at least every quarter, and remove leavers’ accounts on their last day. Higher-risk accounts, such as admin and remote access accounts, may need more frequent checks.
Do I need a data processing agreement with my IT provider?
Yes. If your IT provider processes personal data on your behalf, UK GDPR requires a written contract setting out their responsibilities. This is usually called a data processing agreement (DPA).
Don't wait for a forgotten account to find you
No one meant to leave that door open. But when it comes to your data, “we didn’t know it was there” won’t satisfy the ICO, your clients or your insurer.
The good news is that strong data governance is achievable for every SME. Know your data, own every account, enforce MFA, get your supplier contracts right and keep checking.
At Total Group, we help UK businesses take control of their data with proactive IT support, cyber security and compliance services. We’ll be clear about who’s responsible for what, so nothing gets missed.
Not sure where your business stands? Get in touch with our team today.
Source:
*https://www.bbc.co.uk/news/articles/c6r7y03e9m3ro
**ico.org.uk/action-weve-taken
