Hackers steal children's data after company used 'Password1' to protect old account
Data Cymru and Ogi Networks Limited were reprimanded by regulators after a cyber-attack compromised personal data belonging to 3,300 people, mostly children. Hackers gained access by exploiting an abandoned test account protected by the weak password 'Password1'.
Why it matters
This incident underscores critical cybersecurity vulnerabilities stemming from neglected legacy accounts and poor password management practices.
Image source, Getty Images Image caption, Hackers stole information from Data Cymru's systems in 2024 which exposed the personal information of 3,300 people
A cyber-attack stole information belonging to thousands of children by accessing an account that used the password "Password1", a data watchdog has said.
The Information Commission's Office (ICO) has reprimanded Ogi Networks Limited (ONL) and Data Cymru after the attack on 1 November 2024.
The hackers exposed personal information belonging to 3,300 people, mostly children, by using a test account, known as Test2, which had existed for more than 12 years and was protected by the password that could be compromised in less than a second.
ONL said the account "should have been removed long before criminals were able to use it", adding it had brought in independent cyber-security specialists.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in