Local Government Data Unit – Wales (Data Cymru)
LowConfirmedPublic sector
On 1 November 2024, Data Cymru, a Welsh local government data body, suffered a ransomware attack. The intrusion came through a test account created in 2012 by its supplier Ogi Networks Limited and left active. According to the ICO, 42 GB of data was exfiltrated before about 182.7 GB was encrypted. The information came from two projects supporting children and families and relates to 3,300 people, mostly children. The sources reviewed do not specify the exact types of data involved. On 20 October 2026 the ICO announced reprimands against Data Cymru and Ogi Networks.
- Disclosed on
- October 20, 2026
- Incident dated
- November 1, 2024
- Accounts affected
- 3,300
- Sector
- Public sector
- Country
- GB
- Cause
- Ransomware
Exposed data
- Other personal data
You are only affected if you had an account or an order with this organisation.
What you can do
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
- Welsh firms ‘Password1’ and ‘Test 2’ fails led to hackers stealing children’s dataDataBreaches.net
- « Password1 » is not an appropriate password : deux organisations galloises réprimandées après une cyberattaqueICO
- Local Government Data Unit - Wales (décision d'application de l'ICO)ICO
- Ogi Networks Limited (décision d'application de l'ICO)ICO
- Children's Data Stolen After Ransomware Attack Compromises 'Password1' AccountInfosecurity Magazine
- The RegisterThe Register
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact