“'Password1’ is not an appropriate password”: Two Welsh organisations reprimanded after cyber-attack exposed children’s information
Summary
ICO reprimanded Ogi Networks Limited and Data Cymru after a ransomware attack exposed the personal data of 3,300 people, most of them children. The breach was linked to a long-standing test account protected by a very weak password ('Password1'), highlighting gaps in password hygiene and account management. The ICO urged strong passwords, MFA, routine account reviews, and clear responsibility for cybersecurity when outsourcing, and both organizations took remedial steps, including stronger access controls and a data processing contract.