Children’s data stolen after ransomware hit ‘Password1’ account
Original title: Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ Account
Attackers encrypted 182.7GB and stole 42GB on 3,300 people; the ICO reprimanded both bodies and issued no fine.
The UK Information Commissioner’s Office reprimanded Ogi Networks Limited and Data Cymru over a November 2024 ransomware attack on Data Cymru’s network in Wales. Attackers entered through a test account, “Test 2,” that had existed for more than 12 years and used the password “Password1.” They exfiltrated 42GB and encrypted 182.7GB. The stolen data covered two projects supporting children and families and personal data of 3,300 people, most of them children. Both organizations were found to have infringed UK GDPR, but neither was fined.
- ONL has been Data Cymru’s IT provider since 2012.
- The ICO published the reprimand on October 20.
- ONL later strengthened account controls and signed a compliant processing contract.
- Data Cymru lacked required sub-processor contract terms with ONL.
- The test account was not covered by routine Active Directory reviews.
Impact: Personal data of 3,300 people, mostly children, exfiltrated
- 1.Use strong passwords and protect remote access with multi-factor authentication.
- 2.Review every user account, including old test and local administrator accounts.
- Organizations
- Information Commissioner’s Office
- Countries
- United Kingdom
From the original article
2 min read at infosecurity-magazine.com
The ICO has slammed security failings by the Welsh local government data unit and IT service provider following the 2024 incident
By James Coker · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.