Technology and Scienceupdated 1h ago2 min read
ICO Reprimands Ogi Networks and Data Cymru After Ransomware Attack Exposes Children’s Data
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
ICO reprimanded Ogi Networks and Data Cymru for security failures after Password1 breach. Attack exposed personal data of 3,300 people, mostly children, via a test account.
8 outlets told this the same way.
Outlets did split on Elon Musk Ordered Starlink Slowdown, Disabling Ukrainian Drones And Defenses →
Weak password enabled breach
The Information Commissioner's Office (ICO) reprimanded Ogi Networks Limited (ONL) and Data Cymru after a ransomware attack on 1 November 2024 exposed personal information belonging to 3,300 people, mostly children. The ICO said hackers gained access by using a test account called Test2 that had existed for more than 12 years and was protected by the password "Password1". The ICO found that the ransomware attack encrypted 182.7GB of data and stole 42GB from Data Cymru's systems.
“The Information Commissioner's Office (ICO) has reprimanded Ogi Networks Limited (ONL) and Data Cymru after the attack on 1 November 2024.”
David Doodson, head of investigations at the ICO, said: "Password1 is not an appropriate password, it is a wide-open door to nefarious actors." David Doodson added that "This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands."
ICO cites shared responsibility
The ICO said ONL created the test account in 2012 and used the password "Password1" to protect it, failing to audit it or remove it for more than 12 years. The ICO said ONL also did not review local administrator accounts after they were first deployed, with accounts on three affected systems using the same password for the same period of time. The ICO said Data Cymru failed to put a data protection agreement in place with ONL, creating a gap in responsibility between the two organisations.
The ICO said Data Cymru failed to ensure the dormant test account was identified and removed, or updated to meet stronger password requirements. The ICO urged organisations to "use strong passwords, protect remote access with multi-factor authentication, regularly review every user account, and be completely clear about who is responsible for cyber-security when services are outsourced."
Aftermath and required fixes
ONL said it accepted the ICO's findings and had "acted on them," and it said it brought in independent cyber-security specialists after the attack. ONL told the ICO it worked with Data Cymru within a week of the attack to check every account on its network and switched off the ones it no longer needed that same day. ONL said it protected remote access with multi-factor authentication and introduced regular account reviews for the customers whose networks it looks after.
“On 30 April 2025, Data Cymru and ONL entered into a legally compliant data processing contract.”
A WLGA spokesperson said it remained "committed to maintaining robust information governance standards and continually reviewing the measures we have in place" after the incident. The ICO said that on 30 April 2025, Data Cymru and ONL entered into a legally compliant data processing contract, and it said both organisations introduced stronger security measures following the breach.