Thousands of children have data stolen after two organisations used 'Password1'

Thousands of children have data stolen after two organisations used 'Password1' A watchdog revealed that cybercriminals were able to steal the information of thousands of children after only the passcode 'Password1' was used on an account The data of 3,300 people, mostly children, was stolen from two organisations after the password "Password1" was used to protect a test account. A ransomware attack hit two Welsh organisations - broadband company Ogi Networks Limited (ONL) and the Welsh local government data unit, Data Cymru - on November 1, 2024. The Information Commissioner’s Office (ICO) has reprimanded the two for breaching GDPR rules after the cyber attack. Criminals exploited a test account named "Test2", which had existed for over 12 years. Since it was created in January 2012, the account was only protected with the passcode "Passwrod1", which is classified as "very weak" by a third-party password strength testing tool. This passcode can be compromised in less than a minute, according to the watchdog. The Test2 account had either been active since it was created or was inadvertently reactivated before the incident. The 2024 ransomware attack encrypted 182.7GB of data, with 42GB taken from Data Cymru's systems. This stolen information had been about two projects supporting children and families. Security measures were put in place at the ONL and Data Cymru after the ICO's investigation into the incident. The ONL introduced a process which prompted customers to review active accounts periodically and providing recommendations about accounts that should be removed. The broadband company also strengthened its account access controls, including the use of multi-factor authentication. Data Cymru also brought in periodic account reviews and strengthened account access controls, including the use of multi-factor authentication. On April 30, 2025, both Data Cymru and ONL entered into a legally compliant data processing contract, according to WalesOnline. David Doodson, Head of Investigations at the Information Commission's Office, said: "Password1 is not an appropriate password, it is a wide-open door to nefarious actors. "This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands. The responsibility for these failures did not sit with one organisation alone. "ONL created the test account whilst Data Cymru retained overall control of its network, including the ability to instruct ONL to create or remove accounts. Neither had put in place sufficiently clear and effective measures to ensure that old accounts were routinely identified and removed. "The lesson for every organisation is straightforward: use strong passwords, protect remote access with multi-factor authentication, regularly review every user account, and be completely clear about who is responsible for cyber security when services are outsourced. Basic cyber security controls are not optional, and the negative consequences of not having them can be severe." A spokesperson for Ogi Networks Limited said: “We provided IT services to Data Cymru, and a test account set up on its network in 2012 should have been removed long before criminals were able to use it. We accept the Information Commission’s findings, and we’ve acted on them. “Within a week of the attack, we’d worked with Data Cymru to check every account on its network and switched off the ones it no longer needed that same day. We also brought in independent cyber security specialists to investigate. Since then, we’ve protected remote access with multi-factor authentication and introduced regular account reviews for the customers whose networks we look after, so accounts that aren’t needed are found and removed. This was limited to the server we hosted for Data Cymru. No other customer information held by ONL was affected.” A Welsh local government data unit spokesperson said: “We accept the ICO’s reprimand and take its findings seriously. The reprimand relates to a ransomware attack on Data Cymru’s systems in November 2024. “The incident occurred when Data Cymru was a separate organisation. Data Cymru has subsequently merged with the WLGA, with its staff and functions having been transferred into the Association in 2025. The WLGA has long-established processes in place for reporting, assessing and managing data protection incidents, overseen through its data protection arrangements. "There is no evidence to indicate that the compromised information was shared further or misused. We recognise the fundamental importance of strong information governance and of protecting the information entrusted to organisations working on behalf of local government. “Since the incident, measures have been put in place to strengthen the arrangements identified by the ICO, including the removal of dormant user accounts, strengthened password and remote user access controls, and improved data processing arrangements to clearly define contractual responsibilities for security and audit activities. We remain committed to maintaining robust information governance standards and continually reviewing the measures we have in place.”