Hackers breach children's data through 'Password1' test account

Summarised from 2 outlets · Updated 20 Oct, 19:44 · Archive

Cyber attackers accessed personal information of 3,300 people, mostly children, by exploiting a test account protected only by the password 'Password1' on the network of broadband company Ogi Networks Limited and Welsh local government data unit Data Cymru. The attack occurred on 1 November 2024, encrypting 182.7GB of data, with 42GB taken from Data Cymru's systems. The Information Commissioner's Office reprimanded both organisations for breaching GDPR rules.

The test account, named 'Test2', had existed for over 12 years since its creation in January 2012. When checked against a third-party password strength tool, 'Password1' was classified as 'very weak' and could be compromised in less than a second. David Doodson, head of investigations at the ICO, warned that the password was 'not an appropriate password, it is a wide-open door to nefarious actors'.

The stolen information related to two projects supporting children and families. Following the ICO's investigation, both organisations implemented security improvements including multi-factor authentication and processes for periodic account reviews. ONL also strengthened its account access controls and introduced prompts for customers to review active accounts periodically.

How it is being reported

• Thousands of children have data stolen after two organisations used 'Password1'A watchdog revealed that cybercriminals were able to steal the information of thousands of children after only the passcode 'Password1' was used on an accountThe Mirror · 20 Oct, 19:25
• Cyber attackers hacked thousands of children’s data due to this common password fail‘Password1 is not an appropriate password, it is a wide-open door to nefarious actors’, the ICO’s head of investigations warned in his rebukeThe Independent · 20 Oct, 14:54

In this story: Ogi Networks Limited · Data Cymru · Information Commissioner's Office · Wales · David Doodson

This summary was written by AI from the headlines and standfirsts above, and states as fact only what at least two outlets report. How we use AI · Report a problem