- Published
A cyber-attack stole information belonging to thousands of children by accessing an account that used the password "Password1", a data watchdog has said.
asserted
watchdog → publish → password
The Information Commissioner's Office (ICO) has reprimanded Ogi Networks Limited (ONL) and Data Cymru after the attack on 1 November 2024.
asserted
Office → reprimand → November
The hackers exposed personal information belonging to 3,300 people, mostly children, by using a test account, known as Test2, which had existed for more than 12 years and was protected by the password that could be compromised in less than a second.
uncertain
that → expose → second
ONL said the account "should have been removed long before criminals were able to use it", adding it had brought in independent cyber-security specialists.
asserted
it → say → specialists
The company, which provided IT services to Data Cymru, said it accepted the ICO's findings and had "acted on them".
asserted
it → provide → them
Data Cymru has been approached for comment.
asserted
Cymru → approach → comment
Both organisations were found to have breached UK GDPR rules, external by failing to properly protect their systems and by not regularly checking whether their security measures were effective.
asserted
measures → find → systems
During the ransomware attack, the hackers encrypted 182.7GB of data and stole 42GB from Data Cymru's systems.
asserted
hackers → encrypt → systems
It exposed the personal information related to two projects supporting children and families.
asserted
It → expose → children
David Doodson, head of investigations at the Information Commission's Office, said: "Password1 is not an appropriate password, it is a wide-open door to nefarious actors.
"
asserted
it → say → actors
This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands."
asserted
that → show → thousands
Doodson added the responsibility for "these failures did not sit with one organisation alone".
asserted
responsibility → add → organisation
According to the watchdog, ONL created a test account in 2012 and used the password "Password1" to protect it, failing to audit it or remove it for more than 12 years.
uncertain
ONL → accord → years
It also did not review local administrator accounts after they were first deployed, with accounts on three affected systems using the same password, for the same period of time.
asserted
accounts → review → time
The watchdog said Data Cymru failed to put a data protection agreement in place with ONL, and that there was a gap in responsibility between the two organisations.
It also said Data Cymru failed to ensure the dormant test account was identified and removed, or updated to meet stronger password requirements.
asserted
account → say → requirements
The ICO added it was a lesson for every organisation to "use strong passwords, protect remote access with multi-factor authentication, regularly review every user account, and be completely clear about who is responsible for cyber-security when services are outsourced".
asserted
services → add → security
Following the cyber-attack, both organisations introduced stronger security measures.
asserted
organisations → follow → measures
ONL introduced a process prompting customers to review active accounts periodically and providing recommendations about accounts that should be removed, the ICO said.
asserted
ICO → introduce → accounts
It also strengthened its account access controls, including the use of multi-factor authentication.
asserted
It → strengthen → authentication
On 30 April 2025, Data Cymru and ONL entered into a legally compliant data processing contract.
asserted
Cymru → enter → contract
Data Cymru also introduced periodic account reviews and strengthened account access controls, including using multi-factor authentication.
asserted
Cymru → introduce → authentication
A spokesperson for ONL said: "Within a week of the attack, we'd worked with Data Cymru to check every account on its network and switched off the ones it no longer needed that same day.
"
asserted
it → say → ones
We also brought in independent cyber-security specialists to investigate."
asserted
We → bring → specialists
They added: "Since then, we've protected remote access with multi-factor authentication and introduced regular account reviews for the customers whose networks we look after, so accounts that aren't needed are found and removed.
asserted
that → add → networks
"This was limited to the server we hosted for Data Cymru.
asserted
we → limit → Cymru
No other customer information held by ONL was affected."
asserted
information → hold → ONL
The Aporia
