Hackers steal children's data after company used 'Password1' to protect old account

The Information Commissioner's Office (ICO) has harshly criticized Ogi Networks Limited (ONL) and Data Cymru after a cyber-attack that took place on November 1, 2024. The hackers exploited a dormant account, identified as Test2, which had been in existence for over a decade and used the password "Password1" for protection. This weak password allowed the attackers to gain access to the account in less than a second, thereby exposing personal data of 3,300 individuals, primarily children.

ONL, which provided IT services to Data Cymru, admitted the ICO's findings and took immediate action. The company stated that it had removed the account, instituted independent cyber-security experts, and acted upon their recommendations. Both ONL and Data Cymru were found guilty of breaching UK GDPR rules, primarily due to their failure to safeguard systems adequately and to perform routine security checks.

During the ransomware attack, hackers encrypted 182.7GB of data and stole 42GB from Data Cymru's systems. The personal information exposed pertained to two projects supporting children and families. According to David Doodson, head of investigations at the Information Commissioner's Office, using "Password1" as a password is akin to leaving a "wide-open door" for malicious actors.

Doodson emphasized that the responsibility for these failures was not solely ONL's, highlighting that ONL had created the test account in 2012 and failed to audit or remove it for more than a decade.

The ICO further criticized Data Cymru for not establishing a data protection agreement with ONL and for failing to identify and either update or remove the dormant test account, which used the same password for 12 years. The watchdog urged all organizations to utilize strong passwords, employ multi-factor authentication for remote access, regularly review user accounts, and clarify responsibility when outsourcing services.

Following the cyber-attack, ONL and Data Cymru took steps to bolster their security. ONL established a process for periodically reviewing customer accounts and suggested removal of unnecessary ones, while also enhancing account access controls to include multi-factor authentication. Data Cymru and ONL signed a legally compliant data processing contract on April 30, 2025, and subsequently introduced periodic account reviews and further strengthened account access controls, including the use of multi-factor authentication.

ONL's spokesperson stated that within a week of the attack, they had inspected every account on Data Cymru's network, disabling those no longer needed on the same day. They also introduced independent cyber-security specialists for a thorough investigation. ONL further disclosed that they had implemented multi-factor authentication and initiated regular account reviews for customers whose networks were managed by the company, ensuring that inactive accounts were identified and removed.

This action was confined to the server ONL hosted for Data Cymru; no other customer information was impacted.