Data Breach Exposes 3,300 Children's Information Due to Weak 'Password1' Security
UK watchdog reprimands IT firm and client after ransomware attack highlights severe cybersecurity failures.
Thousands of children's personal details were compromised in a ransomware attack that exploited a long-standing test account protected by the weak password "Password1". The Information Commissioner's Office (ICO) has issued a reprimand to Ogi Networks Limited (ONL) and Data Cymru following the incident on November 1, 2024.
Hackers gained access to the account, which had been active for over 12 years, and encrypted 182.7GB of data while stealing 42GB from Data Cymru's systems. The exposed information related to two projects that support children and families, affecting approximately 3,300 individuals, predominantly children.
According to the ICO, ONL created the test account in 2012 and used "Password1" as its security measure, failing to audit or remove it for more than a decade. The firm also neglected to review local administrator accounts after their deployment, with multiple accounts on affected systems sharing the same easily compromised password.
"Password1 is not an appropriate password, it is a wide-open door to nefarious actors," stated David Doodson, head of investigations at the ICO. "This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands." Doodson emphasized that responsibility for these failures was shared between the organizations.
Data Cymru was found to have breached UK GDPR rules by failing to establish a data protection agreement with ONL, creating a gap in accountability. The organization also did not ensure the dormant test account was identified and removed or updated with stronger password requirements.
Both ONL and Data Cymru have since implemented enhanced security measures. ONL has introduced a process for periodic customer account reviews and strengthened access controls, including multi-factor authentication for remote access. Data Cymru has also adopted similar account review procedures and strengthened access controls.
ONL stated that within a week of the attack, they worked with Data Cymru to review and disable unnecessary accounts on its network. The company also engaged independent cybersecurity specialists for an investigation. Data Cymru and ONL formalized their partnership with a legally compliant data processing contract on April 30, 2025.
The ICO advised all organizations to use strong passwords, protect remote access with multi-factor authentication, conduct regular user account reviews, and clarify cybersecurity responsibilities when outsourcing services. The breach was limited to the server hosted for Data Cymru, and no other ONL customer information was affected.