---
title: "Data breach at Local Government Data Unit – Wales (Data Cymru)"
description: "On 1 November 2024, Data Cymru, a Welsh local government data body, suffered a ransomware attack. The intrusion came through a test account created in 2012 by its supplier Ogi Networks Limited and left active. According to the ICO, 42 GB of data was exfiltrated before about 182.7 GB was encrypted. T"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-10-20-local-government-data-unit-wales-data
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-10-20
dateModified: 2026-10-20
---
# Local Government Data Unit – Wales (Data Cymru)

Data breach — Low

On 1 November 2024, Data Cymru, a Welsh local government data body, suffered a ransomware attack. The intrusion came through a test account created in 2012 by its supplier Ogi Networks Limited and left active. According to the ICO, 42 GB of data was exfiltrated before about 182.7 GB was encrypted. The information came from two projects supporting children and families and relates to 3,300 people, mostly children. The sources reviewed do not specify the exact types of data involved. On 20 October 2026 the ICO announced reprimands against Data Cymru and Ogi Networks.

| Fact | Value |
| --- | --- |
| Disclosed on | October 20, 2026 |
| Incident dated | November 1, 2024 |
| Accounts affected | 3,300 |
| Sector | Public sector |
| Country | GB |
| Cause | Ransomware |
| Severity | Low |
| Status | Confirmed |

## Exposed data

- Other personal data

## What you can do

- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Welsh firms ‘Password1’ and ‘Test 2’ fails led to hackers stealing children’s data](https://databreaches.net/2026/10/20/welsh-firms-password1-and-test-2-fails-led-to-hackers-stealing-childrens-data/) — DataBreaches.net
- [« Password1 » is not an appropriate password : deux organisations galloises réprimandées après une cyberattaque](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/10/password1-is-not-an-appropriate-password) — ICO
- [Local Government Data Unit - Wales (décision d'application de l'ICO)](https://ico.org.uk/action-weve-taken/enforcement/2026/10/local-government-data-unit-wales/) — ICO
- [Ogi Networks Limited (décision d'application de l'ICO)](https://ico.org.uk/action-weve-taken/enforcement/2026/10/ogi-networks-limited/) — ICO
- [Children's Data Stolen After Ransomware Attack Compromises 'Password1' Account](https://www.infosecurity-magazine.com/news/children-data-stolen-password1/) — Infosecurity Magazine
- [The Register](https://www.theregister.com/a/5304139) — The Register

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-10-20-local-government-data-unit-wales-data
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees