TL;DR: What does the Ogi Networks data breach mean for a small business that outsources IT?
In the Ogi Networks data breach, attackers used a test account Ogi created in 2012 with the password "Password1". On 20 October 2026 the UK regulator reprimanded both Ogi and its client Data Cymru, which had no proper contract with Ogi and no routine review of its own accounts. Your move: get a data processing agreement, email your provider five questions and review your user list every quarter.
Here is what happened in the Ogi Networks data breach, with the full timeline, on our sister site MeanCEO. This article takes one lesson from it for founders and small charities who outsource IT.
Like most bootstrapping founders, I hand the tech to a provider and trust them. In the Ogi case the provider made the mistake, and the client got a reprimand too.
What did the ICO decide about Ogi and Data Cymru?
On 20 October 2026 the UK data regulator issued formal reprimands to Ogi Networks Limited, a Welsh broadband and IT provider, and to Data Cymru, the Local Government Data Unit for Wales, according to the ICO's announcement. A ransomware attack on 1 November 2024 hit data from two projects supporting children and families, affecting about 3,300 people, most of them children.
The way in was a test account. Ogi created "Test2" in January 2012 with the password "Password1", and the account was still there more than 12 years later. David Doodson, Head of Investigations, said it plainly: "Password1 is not an appropriate password, it is a wide-open door to nefarious actors."
There was no fine: the Pembrokeshire Herald noted no financial penalties against either organisation. Since 30 September 2026 the regulator is officially the Information Commission, and most people still call it the ICO.
Why was Data Cymru blamed for an account Ogi created?
David Doodson put the lesson for every founder who outsources IT in one line: "The responsibility for these failures did not sit with one organisation alone."
Ogi was Data Cymru's sub-processor and ran its Active Directory, Microsoft's directory of user accounts and permissions on a Windows network. The account was Ogi's work, and Data Cymru kept overall control of its network, including the right to tell Ogi to create or remove accounts. So the regulator found failures on both sides:
In plain words, Article 32 asks you to keep systems secure and test that security regularly, and Article 28 asks for a written contract with every provider that handles your data. The EU GDPR has the same Articles, so a founder in Amsterdam carries the same duty as one in Cardiff.
What do controller, processor and sub-processor mean for my business?
- Controller: the business that decides why and how personal data is used. Run a shop or a charity with a mailing list? That's you.
- Processor: a company or person handling that data for you, such as your IT provider or freelancer.
- Sub-processor: a company your processor hires to do part of the work. Ogi held this role for Data Cymru.
Each link in that chain needs a written contract, and whoever hires the next link checks its work. Our guide to GDPR compliance for European startups covers the controller side in more depth.
What should an IT provider contract or data processing agreement include?
A data processing agreement (DPA) is the part of your IT provider contract that covers personal data. Ask for your provider's standard one and compare it with this list, built from the ICO's findings and Article 28:
- Instructions and confidentiality. Your provider handles your data only on your written instructions, and its staff keep it confidential.
- Security measures, in writing. Password rules, MFA (multi-factor authentication, a second check such as a code on your phone) on admin accounts and remote access, and no shared admin logins.
- Account rules. Who may create accounts, an end date for every test account, and removal when you ask. Data Cymru had that right and never used it on Test2.
- Reviews and audits. A fixed review cycle (I suggest every quarter) and your right to see the results. The ICO faulted Data Cymru for not documenting how the service would be monitored or audited.
- Sub-processors. Every company it hires for your work is named, and the same terms pass down by contract. That's Article 28(4), the clause Data Cymru breached.
- Breach notice and requests. You hear about any incident without delay and get help answering people who ask to see or delete their data.
- End of contract. Your data comes back or gets deleted, and every account the provider set up is closed.
The same list applies to a freelancer who manages your Google Workspace or logins, and femaleswitch.com has a guide for freelancers who look after client accounts. Our articles on contracts and agreements and working with freelancers cover the rest.
Which questions should I ask my IT provider this week?
Copy this email, change the details and send it today. A vague answer tells you a lot.
Subject: Our accounts and data processing agreement
Hi [name],
After the ICO reprimands in the Ogi Networks case, I'm checking our setup. Could you send me:
1. A list of every account you created on our systems, test and admin accounts included, with each one's last use.
2. Confirmation that multi-factor authentication is on for admin accounts and remote access.
3. Whether any admin login is shared, and your plan to give each person their own.
4. Our signed data processing agreement, or a draft if we don't have one yet.
5. The names of any other companies that work on our systems or data.
Could we also agree on a short account review every three months?
Thank you,
[your name]
Still deciding what to hand over? Our guide on what to outsource and what to keep in-house helps you draw the line.
How can a non-technical founder run a quarterly account review?
Any founder can do this in 30 minutes. Google Workspace and Microsoft 365 both show every account in one admin list. Book a slot every three months and follow these steps:
- Open the user list. In Google Workspace: admin.google.com, Directory, Users. In Microsoft 365: admin.microsoft.com, Users, Active users.
- Check every name. Each account belongs to one real person who still works with you. Watch for test accounts, former staff and old freelancers.
- Suspend what nobody needs. Delete it a month later. Test2 survived for 12 years because nobody did this step.
- Turn on MFA for everyone. Google calls it 2-Step Verification, Microsoft calls it multifactor authentication. Start with admin accounts.
- End shared admin logins. Give each admin a named account, so you can remove one person without resetting everyone's password.
- Write it down. Note the date and what you changed. That page proves you review accounts on a schedule, which Data Cymru couldn't show.
The ICO also advises blocking weak and common passwords. For more habits, see our cybersecurity guide for non-technical entrepreneurs and our list of data security practices for startups. WordPress site? Our no-developer plan for the PHP vulnerability is this month's companion checklist.
What did Ogi and Data Cymru change after the attack?
Data Cymru and Ogi signed a legally compliant data processing contract on 30 April 2025, six months after the attack. Both added account reviews and MFA. In a statement reported by The Independent, Ogi accepted the findings and said the test account should have been deleted long before criminals exploited it. Both made these cheap fixes after the attack. Make yours before.
Building your first startup on a budget?
The Fe/male Switch startup game takes you from idea to first paying customers in weekly quests, with an AI co-founder and a community of founders.
👉 Start the game
FAQ: the Ogi Networks data breach and your IT provider
What was the Ogi Networks data breach?
A ransomware attack on 1 November 2024 on Data Cymru's systems. Attackers got in through a test account that its IT provider, Ogi Networks, created in 2012 with the password "Password1". About 3,300 people were affected, most of them children.
Was Ogi Networks fined?
No. The UK regulator issued formal reprimands to Ogi Networks and Data Cymru on 20 October 2026 and announced no financial penalty against either.
Why was the client reprimanded if the IT provider created the account?
Data Cymru kept control of its network and could tell Ogi to remove accounts. It also had no contract with the terms Article 28(4) requires.
What is a data processing agreement?
A written contract with a provider that handles personal data for you, covering instructions, security, sub-processors, breach notice and the end of the contract. UK GDPR Article 28 requires one.
Does this apply to businesses in the EU?
Yes. The EU GDPR has the same Articles 28 and 32, so EU businesses that outsource IT carry the same duties.
When should I review user accounts?
Every quarter. The ICO faulted reviews that weren't scheduled or routine, and a quarterly check gives you a clear schedule.
