In a cyber-attack on 1 November 2024, hackers accessed a test account protected by the weak password "Password1" on Data Cymru's systems, exposing personal information of 3,300 people, mostly children, the Information Commissioner's Office (ICO) has reported. The account, created by Ogi Networks Limited (ONL) in 2012, remained active for over 12 years without proper auditing or removal. The attack involved encrypting 182.7GB of data and stealing 42GB related to projects supporting children and families.
The ICO found that both ONL and Data Cymru breached UK GDPR rules by failing to secure their systems adequately and not regularly reviewing security measures. Data Cymru merged with the Welsh Local Government Association (WLGA) in 2025, which stated there was no evidence the stolen data was further shared or misused. Following the incident, both organisations implemented stronger security protocols, including multi-factor authentication and regular account reviews, highlighting the importance of robust cybersecurity practices, especially when services are outsourced.
Read the full story: BBC UK News.
Source: BBC UK News. Aggregated summary, not independent reporting.