Hackers steal personal data of thousands of children after UK company breached using the password ‘Password1’

Hackers stole the personal data of 3,300 people, most of them children, through an account using the password “Password1”.

The Information Commissioner’s Office (ICO) has reprimanded Data Cymru, the Local Government Data Unit for Wales, and its IT provider Ogi Networks Limited over the ransomware attack.

The attack took place on 1 November 2024 and encrypted 182.7GB of data, with the hackers taking 42GB from Data Cymru’s systems.

The stolen information related to two projects that support children and families in Wales. The attackers got in through a test account called “Test2”, which Ogi Networks created in January 2012 with the password “Password1”.

The account sat on Data Cymru’s network for more than 12 years, either remaining active throughout or returning to use through an accidental reactivation before the attack.

A third-party password strength tool rated “Password1” as very weak and estimated that hackers could crack it in under a second.

“Password1 is not an appropriate password, it is a wide-open door to nefarious actors,” said David Doodson, Head of Investigations at the ICO.

“This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands,” he added.

Both organisations at fault

The ICO found that Ogi Networks broke the UK GDPR by failing to keep its systems secure and failing to regularly test whether its security measures worked.

The firm never audited the accounts it created on Data Cymru’s network, leaving the unnecessary test account in place for over six years after its GDPR obligations took effect.

Ogi Networks also never reviewed local administrator accounts after setting them up, and three affected systems kept the same password for more than 12 years.

The regulator found that Data Cymru had no contract with Ogi Networks containing the data protection terms the law requires when appointing a sub-processor.

Data Cymru also failed to remove the dormant account or bring it in line with the stronger password rules it later introduced.

Its account reviews were neither scheduled nor routine, and they did not cover every account in the system that manages user access on its network.

“The responsibility for these failures did not sit with one organisation alone,” Doodson said.

Since the attack, Ogi Networks has started prompting customers to review their active accounts periodically and recommending which ones they should remove.

Both organisations have introduced multi-factor authentication and tighter account access controls, and they signed a legally compliant data processing contract on 30 April 2025.

The ICO urged organisations to take several basic steps, including:

• Removing test, dormant and former-user accounts that are no longer required
• Blocking weak and commonly used passwords such as “Password1”
• Applying multi-factor authentication to remote access by default
• Giving privileged accounts unique passwords rather than sharing them across systems
• Setting out clearly in contracts how IT providers will deliver and monitor security

“Basic cyber security controls are not optional, and the negative consequences of not having them can be severe,” Doodson said.

Now read: Global online security scare after certification authority is compromised