Hackers steal children’s data after company used “Password1” to protect old account

Hackers stole the personal information of thousands of children by accessing an old test account protected by the password “Password1,” a UK data watchdog has said, according to BBC.

The watchdog, the Information Commission’s Office (ICO), reprimanded Ogi Networks Limited (ONL) and Data Cymru over the attack on 1 November 2024. The hackers exposed the personal information of 3,300 people, mostly children, using a test account called Test2. The account had existed for more than 12 years and its password could be cracked in under a second.

During the ransomware attack, the hackers encrypted 182.7GB of data and stole 42GB from Data Cymru’s systems. The data related to two projects supporting children and families.

ONL created the account in 2012 and never audited or removed it. Accounts on three affected systems also shared the same password for the same period. The ICO said Data Cymru failed to put a data protection agreement in place with ONL. Both were found to have breached UK GDPR rules.

“Password1 is not an appropriate password, it is a wide-open door to nefarious actors,” said David Doodson, the ICO’s head of investigations. He added: “This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands.”

ONL said the account “should have been removed long before criminals were able to use it.” It has since introduced multi-factor authentication and regular account reviews. Data Cymru, which merged with the Welsh Local Government Association in 2025, said there was no evidence the stolen information was shared further or misused.