Cyber attackers hacked thousands of children's data due to this common password fail

Want to bookmark your favourite articles and stories to read or reference later? Start your Independent Membership today.

Already a member? Log in

Cyber attackers breached thousands of children’s data through a test account with a “very weak” password , the data watchdog has revealed as a stark warning to others.

The Information Commissioner’s Office (ICO) reprimanded broadband company Ogi Networks Limited (ONL) and Wales ’ local government data unit, Data Cymru, for breaching GDPR rules after the personal information of 3,300 people was accessed by cyber criminals.

Most of the data related to children, as the compromised information related to two projects supporting families.

Hackers gained access by exploiting a test account, set up by ONL on Data Cymru’s network in November 2024 and active for 12 years, known as “Test 2”, which was protected only with the passcode “Password1”, the ICO said.

This code, when checked against a third-party password strength tool, was classified as “very weak” and could be compromised in less than a second, according to the watchdog.

David Doodson, head of investigations at the ICO, said the weak password had left the door wide open to a serious cyber attack.

“ Password1 is not an appropriate password , it is a wide-open door to nefarious actors,” he said. “This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands.

“The responsibility for these failures did not sit with one organisation alone. ONL created the test account whilst Data Cymru retained overall control of its network, including the ability to instruct ONL to create or remove accounts. Neither had put in place sufficiently clear and effective measures to ensure that old accounts were routinely identified and removed.”

“The lesson for every organisation is straightforward: use strong passwords, protect remote access with multi-factor authentication, regularly review every user account, and be completely clear who is responsible for cyber security when services are outsourced. Basic cyber security controls are not optional, and the negative consequences of not having them can be severe,” he added.

More than 180GB of data was taken through a ransomware attack, 42GB coming from Data Cymru’s systems, the watchdog reported.

The ICO found that ONL failed to apply appropriate password-strength and complexity requirements to the “Test 2” account set up on January 2012.

The watchdog found that it also failed to conduct regular audits of accounts created within Data Cymru’s network, allowing the “operationally unnecessary” test account to exist for more than 12 years, including over six years after ONL’s obligations under the GDPR came into effect.

Accounts on three affected systems had retained the same password for more than 12 years, the ICO found, as ONL had not reviewed local administrator accounts after they were initially deployed.

Data Cymru was criticised after it was found not to have a contract in place with ONL that had legally mandated data protection terms. It also failed to ensure that the dormant “Test 2” account was identified and removed, or updated to comply with password requirements later introduced.

Since the incident, ONL and Data Cymru entered into a legally compliant data processing contract. Both organisations have strengthened account reviewing processes with multi-factor authentication, the report said.

A spokesperson for Ogi Networks Limited said: “We provided IT services to Data Cymru, and a test account set up on its network in 2012 should have been removed long before criminals were able to use it. We accept the Information Commission’s findings, and we’ve acted on them.

“Within a week of the attack, we’d worked with Data Cymru to check every account on its network and switched off the ones it no longer needed that same day. We also brought in independent cyber security specialists to investigate. Since then, we’ve protected remote access with multi-factor authentication and introduced regular account reviews for the customers whose networks we look after, so accounts that aren’t needed are found and removed.

“This was limited to the server we hosted for Data Cymru. No other customer information held by ONL was affected.”

The Independent has contacted Data Cymru for .

Join our commenting forum

Join thought-provoking conversations, follow other Independent readers and see their replies