Hackers steal children's data after company used 'Password1' to protect old account
Summary
Hackers stole personal information of 3,300 people, mostly children, from Data Cymru after accessing an old test account protected by the weak password "Password1." The Information Commissioner's Office (ICO) found that both Data Cymru and its IT provider Ogi Networks Limited (ONL) failed to properly protect their systems and did not regularly check their security.Key Facts
- The cyber-attack happened on November 1, 2024, affecting Data Cymru’s systems.
- Hackers used a test account named Test2, which had the weak password "Password1" for over 12 years.
- This password could be hacked in less than a second and allowed access to sensitive data.
- Personal information related to two projects supporting children and families was exposed.
- ONL created the test account in 2012 and did not review or remove it for more than a decade.
- Data Cymru and ONL did not have a proper data protection agreement, causing unclear responsibility for security.
- Both organizations have since improved their security by adding strong passwords, multi-factor authentication, and regular account reviews.
- The ICO said this case shows the importance of strong passwords and clear cyber-security roles, especially when services are outsourced.
Read the Full Article
This is a fact-based summary from The Actual News. Click below to read the complete story directly from the original source.
