// BBC UK NEWS — CRONACA
Hackers steal children's data after company used 'Password1' to protect old account
Hackers stole information from Data Cymru's systems in 2024 which exposed the personal information of 3,300 people
A cyber-attack stole information belonging to thousands of children by accessing an account that used the password "Password1", a data watchdog has said.
The Information Commission's Office (ICO) has reprimanded Ogi Networks Limited (ONL) and Data Cymru after the attack on 1 November 2024.
The hackers exposed personal information belonging to 3,300 people, mostly children, by using a test account, known as Test2, which had existed for more than 12 years and was protected by the password that could be compromised in less than a second.
ONL said the account "should have been removed long before criminals were able to use it", adding it had brought in independent cyber-security specialists.
The company, which provided IT services to Data Cymru, said it accepted the ICO's findings and had "acted on them".
Data Cymru merged with the Welsh Local Government Association (WLGA) in 2025, who said there was no evidence the stolen information was "shared further or misused".
ONL and Data Cymru were found to have breached UK GDPR rules, external by failing to properly protect their systems and by not regularly checking whether their security measures were effective.
During the ransomware attack, the hackers encrypted 182.7GB of data and stole 42GB from Data Cymru's systems. It exposed the personal information related to two projects supporting children and families.
David Doodson, head of investigations at the Information Commission's Office, said: "Password1 is not an appropriate password, it is a wide-open door to nefarious actors.