ICO reprimands firms over attack exposing children’s data

The Information Commissioner’s Office has reprimanded Ogi Networks Limited and Data Cymru over a ransomware attack that exposed personal information belonging to 3,300 people, mostly children, after attackers accessed a long-standing test account protected by a weak password. The attack took place on November 1, 2024. According to the ICO, the account, called Test2, had existed for more than 12 years and was protected by the password “Password1.” The watchdog said it had not been routinely identified and removed. The account was created by Ogi Networks Limited on Data Cymru’s network, while Data Cymru retained overall control of that network, the ICO said. The attack encrypted 182.7 gigabytes of data, and 42 gigabytes were taken from Data Cymru’s systems, according to the watchdog. The affected personal information related to two projects supporting children and families. The ICO said accounts on three affected systems had retained the same password for more than 12 years, and found that both organisations failed to ensure old accounts were properly managed. The reprimands also addressed gaps in the organisations’ arrangements for data protection and security responsibilities....