Startup Playbook: success through failure

Ogi Networks Data Breach: What Freelancers Who Create Logins on Client Systems Must Fix Now

TL;DR: What does the Ogi Networks data breach mean for freelancers?

The Ogi Networks data breach began with a test account, "Test2", that an IT supplier created on a client's network in January 2012 with the password "Password1" and never reviewed. Attackers used it in November 2024, and on 20 October 2026 the UK regulator reprimanded supplier and client. If you create logins on client systems, keep an account ledger, close every account at handover, never share admin logins, use MFA by default, put these duties in your contract and sell a quarterly access review as a paid care plan.

The Ogi Networks data breach is trending across the UK this week, and MeanCEO covers what happened and what the regulator found in full. This guide is for the people who create the accounts: freelancers, IT contractors, agency freelancers and first-time founders who set up logins on CLIENT systems. The regulator reprimanded the supplier that made the account, and that supplier's job looks a lot like yours.

What happened in the Ogi Networks data breach?

According to the Information Commission's Office announcement, attackers hit Data Cymru, the Local Government Data Unit for Wales, with ransomware on 1 November 2024. They encrypted 182.7GB and took 42GB from two projects supporting children and families. About 3,300 people were affected, most of them children.

Ogi Networks Limited, a Welsh broadband and IT provider, ran Data Cymru's Active Directory (Microsoft's directory of user accounts and permissions on a Windows network) as a sub-processor. It created "Test2" with "Password1" in January 2012, and the account was still there more than 12 years later. A password checker said it falls "in less than a second".

Both organisations got a formal reprimand and, as the Pembrokeshire Herald notes, no fine. The UK regulator is now the Information Commission: on 30 September 2026 the Data (Use and Access) Act 2025 replaced the office of the Information Commissioner, and people still call it the ICO.

Why should a freelancer care about one forgotten test account?

Because the regulator named the supplier. It found Ogi breached UK GDPR Article 32(1)(b) and 32(1)(d): no password rules on the account, no regular audit of the accounts it created, and local admin passwords unchanged for more than 12 years on three systems.

Data Cymru got its own list. It had no contract with Ogi carrying the data protection terms Article 28(4) requires for a sub-processor, and its account reviews were irregular and incomplete. David Doodson, Head of Investigations at the Information Commission's Office, put it this way: "The responsibility for these failures did not sit with one organisation alone."

Your client is the controller, the business that decides why personal data is used. When you log into their website, shop, CRM or server and touch customer data, you act as their processor. Hired through an agency, you are a sub-processor, exactly where Ogi sat. Articles 28 and 32 read the same in the EU GDPR, so freelancers in Amsterdam or Valletta face the same rules. See our GDPR compliance guide for startups for the wider rules.

Ogi accepted the findings and said the account should have been deleted long before criminals exploited it, as reported by The Independent. A "test" admin you leave on a client's WordPress site is the same story at a smaller scale.

What is an account ledger, and how do you keep one?

An account ledger is a running list of every account, admin login, API token and app password you create on a client system. Each entry takes two minutes. Keep one per client, in a shared sheet the client can see.

Field	What to write	Sample entry
System	Where the account lives	Client WordPress, live site
Account	Username or token name	test-editor
Type	Admin, editor, test, API, SFTP	Test account
Created	Date and who created it	3 Mar 2026, you
Purpose	Why it exists	Checking the new booking form
Remove by	The date it must go	End of project
Status	Live, removed or handed over	Removed 28 Mar 2026

Test2 survived because nobody put a "Remove by" date on it. Keep the passwords themselves in a password manager, never in the ledger; our list of cybersecurity tools for startups has options.

What goes on an end-of-project access handover checklist?

On the last day of a project, temporary accounts turn permanent. Run this list before the final invoice.

If the client keeps you on for support, downgrade your login to the lowest role that still works. Send new passwords through a password manager or a one-time secret link, never by plain email.

Why do shared admin logins and missing MFA come first?

The regulator's advice reads like a freelancer's to-do list: remove unneeded accounts, block weak and common passwords, use MFA by default for remote access, audit all accounts and permissions, avoid shared admin credentials and put security duties in contracts.

One person, one login. With a shared "admin" account, nobody can tell who did what, and nobody dares delete it.
MFA (multi-factor authentication) on every admin account: a code from an app on top of the password. Ogi and Data Cymru both added it after the attack.
Block the obvious passwords. "Password1" passes many old length rules and still falls in under a second.

Use the same habits in your own business, as our cybersecurity guide for women-led startups shows.

What security duties belong in your freelance contract?

Data Cymru's missing contract terms were a breach in their own right. Write the security work into your statement of work. Our guide to contracts every entrepreneur needs covers the rest of the agreement.

Access: named accounts only, with MFA and no shared logins.
Records: the freelancer keeps an account ledger and hands it over at the end.
Handover: test accounts removed and passwords rotated within 5 working days of the project end.
Incidents: any suspected breach reported to the client the same day.
Reviews: ongoing access checked every quarter, as a paid service.

Add a short data processing clause as well. A starting point:

Data processing. The Freelancer processes personal data only on the Client's written instructions and only for this project. The Freelancer keeps it confidential, uses named accounts with multi-factor authentication, removes temporary and test accounts at handover, does not bring in another processor without the Client's written consent on the same terms, tells the Client without undue delay about any personal data breach, and deletes or returns the data when the project ends.

Have a lawyer check it once against your country's law, then reuse it. For the client side, the Fe/male Switch Foundation explains what to put in your IT provider contract.

How do you turn a quarterly access review into a paid care plan?

Ogi now prompts its customers to review accounts periodically, and freelancers can sell exactly that. A quarterly access review takes an hour or two per client and fits inside a monthly care plan next to updates and backups, as in our PHP vulnerability plan for freelancers.

Price it per client per month with a fixed number of systems, and book the review dates on day one. Our post on subscription business models shows why recurring revenue suits a solo business, and our tips on freelance project management keep reviews on schedule across many clients.

What message can you send your clients this week?

The news gives you a reason to get in touch. Adapt this:

Hi [name], you may have seen the UK regulator reprimand an IT supplier this week over a test account it created in 2012 and never removed. I'd like to check your systems for anything similar. I'll list every account I created for you, remove what's no longer needed, change old passwords and switch on two-step login for admins. It takes about an hour and you get a one-page summary. I can repeat it every quarter as part of a care plan. Shall I start on [date]?

Turn your skills into your first startup

The Fe/male Switch startup game takes you from idea to first paying customers in weekly quests, with an AI co-founder and a community of founders.

👉 Start the game

FAQ: the Ogi Networks data breach for freelancers

What was the Ogi Networks data breach?

A ransomware attack on Data Cymru on 1 November 2024 through Test2, a test account Ogi Networks created in 2012 with the password Password1. About 3,300 people were affected, mostly children.

Was Ogi Networks fined?

No. On 20 October 2026 the regulator issued formal reprimands to Ogi Networks and Data Cymru and announced no financial penalties.

Why did the regulator reprimand the IT supplier too?

Ogi created the account and never audited its accounts regularly, which breached Article 32 of UK GDPR. Data Cymru was reprimanded under Articles 28(4) and 32.

Am I a processor as a freelancer?

Yes, when you handle personal data for a client, such as customer records in their shop or CRM. Through an agency, you are a sub-processor. The EU GDPR has the same rules.

What should I do with test accounts on client systems?

Log each one with a removal date, give it a strong unique password and MFA, and delete it by the end of the project.

Who is the UK data protection regulator now?

The Information Commission, which replaced the Information Commissioner on 30 September 2026 under the Data (Use and Access) Act 2025.

About the Author

Violetta Bonenkamp, also known as MeanCEO, is an experienced startup founder with an impressive educational background including an MBA and four other higher education degrees. She has over 20 years of work experience across multiple countries, including 5 years as a solopreneur and serial entrepreneur. Throughout her startup experience she has applied for multiple startup grants at the EU level, in the Netherlands and Malta, and her startups received quite a few of those. She’s been living, studying and working in many countries around the globe and her extensive multicultural experience has influenced her immensely.

Violetta Bonenkamp

2026-10-21 22:27 news