Watchdog reprimands Welsh IT firm and data body after hackers stole children's details through a 'Password1' account

The 'Test2' login was created by Ogi Networks on Data Cymru's network in 2012 and sat unchanged for over a decade. Testing showed 'Password1' could be broken in less than a second. Ransomware attackers breached the system on 1 November 2024, making off with records belonging to 3,300 individuals, the majority of them children. ICO investigations chief David Doodson described the password as 'a wide-open door to nefarious actors'.

The gang stole 42GB of data and encrypted another 182.7GB on Data Cymru's servers.

Administrator accounts on three hit systems kept the same password for over 12 years.

Ogi Networks admitted the account 'should have been removed long before criminals' used it.