UK watchdog reprimands Ogi Networks and Data Cymru over children's data breach

The UK Information Commissioner's Office has reprimanded Ogi Networks Limited and Data Cymru over security failures that exposed personal information belonging to 3,300 people, mostly children, the BBC reported. Attackers accessed a dormant test account protected by "Password1" during the 1 November 2024 ransomware attack. The watchdog found that Ogi had failed to audit or remove the account for more than 12 years. Data Cymru lacked a data protection agreement with its IT provider and failed to ensure the account was removed or secured. Both organisations subsequently introduced account reviews and stronger access controls, including multi-factor authentication.