ICO reprimands two Welsh bodies after children's data taken
Original title: Two Welsh organisations reprimanded after cyber-attack exposed children’s information
A November 1, 2024 ransomware attack used a 12-year-old Test2 account protected by the password Password1 and took 42GB.
The UK Information Commissioner's Office reprimanded Ogi Networks Limited and Data Cymru after ransomware encrypted 182.7GB and took personal information on 3,300 people, most of them children. Attackers used a Test2 account created in January 2012 with the password Password1. The ICO found both organisations failed UK GDPR security and account-review duties, and Data Cymru lacked a required processor contract. Both later added account reviews and multi-factor authentication.
Unconfirmed: The ICO does not name the ransomware strain or say whether the stolen data was published.
- The taken data, 42GB, related to two projects supporting children and families.
- The Test2 password was rated very weak and crackable in under a second by a strength tool.
- Local administrator accounts on three systems kept the same password for more than 12 years.
- A compliant data-processing contract was signed on April 30, 2025.
- The ICO issued reprimands, not described financial penalties.
Impact: Personal data of 3,300 people, mostly children, stolen
- 1.Remove dormant and test accounts and block weak passwords such as Password1.
- 2.Require multi-factor authentication on remote access and use unique privileged credentials.
- 3.Spell out security monitoring and audit duties in processor and sub-processor contracts.
- Organizations
- Information Commissioner's Office
- Countries
- United Kingdom
From the original article
3 min read at ico.org.ukWe have issued reprimands to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, following a ransomware attack. During the attack the personal information of 3,300 people was taken, the majority of whom were children.
By ico.org.uk via ettolrach · ico.org.uk
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.