In November 2024, ransomware attackers exploited a 'Password1' password to breach the network of Data Cymru, a Welsh local government data unit, and its IT service provider, Ogi Networks Limited (ONL), compromising the personal data of 3300 individuals.
The vulnerability or weakness
The attackers gained access via a 12-year-old test account protected by the weak password 'Password1', which was a significant security flaw.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Both organizations were found to have infringed UK GDPR, leading to a reprimand but no fine. The incident highlights the severe operational and reputational risks of weak password policies and inadequate account management.
Industries affected
This incident primarily affects local government and IT service providers in the UK.
Users affected
3300 people, the majority of whom were children, had their personal data exposed, potentially leading to identity theft or other forms of cybercrime.
Build these skills
Watch the daily brief
Sources
- Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ Account (Infosecurity Magazine)
