When did your school last review the accounts nobody uses?
A test login created during an installation can be easy to forget. The project finishes, the system works and attention moves elsewhere. I'd put those accounts on the agenda at the next meeting with your IT provider.
What happened
On 20 October 2026, the ICO announced reprimands for Ogi Networks Limited and Data Cymru following a ransomware attack on 1 November 2024. Information about 3,300 people, mostly children, was taken.
Attackers exploited an account called Test2. It had existed for more than 12 years with the password Password1. The ICO says it had either stayed active or been reactivated before the incident.
Ogi created the account. Data Cymru controlled its network and could request account removal. The ICO found gaps in account reviews, contractual terms and the allocation of security responsibilities.
What I'd ask your IT provider
This wasn't a school incident. But it raises questions that belong in a school or trust's next service review:
- Can we see the latest account review, including test accounts and supplier access?
- Does every account have a named owner who can explain why it's needed?
- Who approves removal, and how do we confirm it's happened?
- What evidence will governors or trustees receive that agreed checks are being completed?
Ask for the review date, its scope and the actions taken. A reassuring answer is easier to assess when there's a record behind it.
Agree who does what
The ICO recommends blocking weak passwords, applying multi-factor authentication to remote access, reviewing the whole account environment and clearly defining supplier responsibilities.
For a school leader, my suggested next step is a short conversation involving the IT lead, the data protection lead and the provider. Give the account review an owner and a date. Then agree how unresolved findings will reach the leadership team.
Could your provider show you today which accounts still need access, and who checked?