Hackers stole data of 3,300 people, mostly children, due to the password 'Password1'

The key facts

Hackers encrypted 182.7 GB of data and stole 42 GB from Data Cymru's systems in a ransomware attack on 1 November 2024
The Test2 test account, created by ONL in 2012, existed for more than 12 years with the password 'Password1' and was never audited
Both companies were found in breach of the UK GDPR; after the incident they strengthened security measures and concluded a data processing agreement on 30 April 2025

Weak password opened access to the data of thousands of people

Hackers stole information about thousands of children after gaining access to an account protected by the password 'Password1', the UK data protection regulator (ICO) reported. The attack on Data Cymru's systems took place on 1 November 2024. The ICO issued reprimands to Ogi Networks Limited (ONL), which provided IT services to Data Cymru, and to Data Cymru itself. As a result of the attack, the personal information of 3,300 people, mostly children, was exposed. The attackers used a test account named Test2, which had existed for more than 12 years and was protected by a password that could be cracked in less than a second.

Course of the attack and scale of the breach

During the ransomware attack, hackers encrypted 182.7 GB of data and stole 42 GB from Data Cymru's systems. The breach affected personal data related to two projects supporting children and families.

Breaches of the UK GDPR

Both organisations, according to the regulator's findings, breached UK GDPR rules by failing to adequately protect their systems and by not regularly reviewing the effectiveness of security measures. According to the ICO, ONL created the test account in 2012 with the password 'Password1' and for more than 12 years neither audited nor deleted it. The company also failed to review local administrator accounts after their deployment: accounts on the three affected systems used the same password throughout the same period. The ICO noted that Data Cymru had not concluded a data protection agreement with ONL, which created a gap in areas of responsibility between the organisations, and had also failed to identify and remove the inactive test account or bring it into line with stricter password requirements.

Reaction of the regulator and the companies

David Dodson, head of investigations at the ICO, said: 'Password1 is not an appropriate password, it is an open door for attackers.' According to him, the incident shows how a single weak password, attached to an account that was no longer needed, can open the way to a serious cyberattack affecting thousands of people. Dodson added that responsibility 'for these failures did not lie with a single organisation'. ONL stated that the account 'should have been deleted long before criminals were able to use it' and that it accepted the ICO's findings and 'acted on them'. Data Cymru did not respond to a request for comment.

Measures after the incident

After the attack, both organisations strengthened their security measures. ONL introduced a process of periodic review of active customer accounts with recommendations to delete unnecessary ones, and also reinforced access controls, including multi-factor authentication. On 30 April 2025, Data Cymru and ONL concluded a lawful data processing agreement. Data Cymru also introduced periodic account reviews and strengthened access controls using multi-factor authentication. An ONL representative said that within a week of the attack the company, together with Data Cymru, reviewed all accounts on its network and disabled unnecessary ones the same day, and also engaged independent cybersecurity specialists to conduct an investigation. According to the representative, the incident affected only the server hosted for Data Cymru, and the information of ONL's other clients was not affected.

ICO conclusions

The ICO emphasised that the incident is a lesson for every organisation: use strong passwords, protect remote access with multi-factor authentication, regularly review all accounts, and clearly define who is responsible for cybersecurity when outsourcing services.