Hackers Steal Children's Data After Company Used 'Password1' for Old Account
BBC News reports on a recent cyber-attack that compromised the data of thousands of children.
Image source: Getty Images
Image caption: Hackers stole personal information from Data Cymru's systems in 2024, affecting 3,300 people, mostly children.
By Angharad Thomas, BBC Wales
A cyber-attack in 2024 revealed the personal details of 3,300 individuals, primarily children, after hackers exploited an account protected by the password "Password1," which took less than a second to crack.
The Information Commissioner's Office (ICO) has issued a reprimand to Ogi Networks Limited (ONL) and Data Cymru over the incident.
ONL stated that the account in question "should have been removed" long before the breach and has since hired independent cyber-security specialists.
Data Cymru, which received IT services from ONL, acknowledged the ICO's findings and implemented the necessary changes.
The ICO's findings highlighted several breaches:
- Both organisations failed to adequately protect their systems.
- They did not regularly test the effectiveness of their security measures.
During the attack, hackers encrypted 182.7GB of data and stole 42GB from Data Cymru's systems, exposing personal information related to two children and families' support projects.
David Doodson, head of investigations at the ICO, emphasized the importance of strong passwords, stating that "Password1" is "a wide-open door to nefarious actors."
He also noted the responsibility gap between ONL and Data Cymru, as neither organisation had a clear data protection agreement in place.
The ICO's report serves as a reminder for organizations to:
- Use strong, unique passwords.
- Implement multi-factor authentication for remote access.
- Regularly review and update user accounts.
- Define roles and responsibilities for cyber-security, especially when outsourcing services.
Following the attack, both organizations have enhanced their security measures. ONL introduced a process for periodic account reviews, while Data Cymru implemented a data processing contract and improved its account access controls.