Hackers steal children’s data through dormant test account
The Information Commissioner's Office reprimanded Ogi Networks Limited and Data Cymru after a ransomware attack exposed personal information belonging to 3,300…
Ogi Networks Limited and Data Cymru were reprimanded by the UK data watchdog after a ransomware attack exposed personal information belonging to 3,300 people, mostly children. Hackers accessed a dormant test account protected by the password “Password1,” the Information Commissioner's Office (ICO) said.
The attack took place on 1 November 2024 and exposed information connected to two projects supporting children and families. Hackers encrypted 182.7GB of data and stole 42GB from Data Cymru’s systems, according to the ICO.
The account was called Test2. It had existed for more than 12 years, and the password could be compromised in less than a second.
Weak password went unchecked for years
ONL created the test account in 2012 but did not audit it or remove it, the watchdog said. It also found that local administrator accounts on three affected systems used the same password and were not reviewed after deployment.
David Doodson, head of investigations at the ICO, said: “Password1 is not an appropriate password, it is a wide-open door to nefarious actors.”
He said the incident showed how an unused account with a weak password could leave systems open to a serious attack affecting thousands. Doodson also said responsibility for the failures “did not sit with one organisation alone”.
The ICO found both ONL and Data Cymru breached UK GDPR rules by failing to protect their systems properly and regularly check whether security measures worked. Data Cymru had not put a data protection agreement in place with ONL, which provided IT services to it, leaving a gap in responsibility between the organizations, the watchdog said.
The breach put personal information tied to services for children and families at risk. The Welsh Local Government Association (WLGA), which merged with Data Cymru in 2025, said there was no evidence the stolen information was “shared further or misused”.
Organizations added account checks
ONL said the test account “should have been removed long before criminals were able to use it”. The company said it accepted the ICO’s findings and had acted on them.
An ONL spokesperson said the company worked with Data Cymru within a week of the attack to check every account on its network and switch off accounts it no longer needed. It also brought in independent cyber-security specialists to investigate.
“Since then, we've protected remote access with multi-factor authentication and introduced regular account reviews for the customers whose networks we look after,” the spokesperson said. ONL added that the incident was limited to the server it hosted for Data Cymru and no other customer information held by ONL was affected.
The ICO said ONL introduced a process asking customers to review active accounts periodically and offering recommendations about accounts to remove. The company also strengthened access controls, including multi-factor authentication.
Data Cymru introduced periodic account reviews and stronger access controls as well. On 30 April 2025, it and ONL entered into a legally compliant data processing contract.
The ICO urged organizations to use strong passwords, protect remote access with multi-factor authentication, regularly review user accounts and clearly assign responsibility when they outsource cyber-security. Hackers encrypted 182.7GB of data in the attack.
Source: bbc.co.uk
