"Dyw 'Password1' ddim yn gyfrinair priodol": Ceryddu dau sefydliad Cymreig ar ôl i seiberymosodiad ddatgelu gwybodaeth plant

What happened

The UK Information Commissioner's Office (ICO) issued enforcement notices to Ogi Networks Limited and Data Cymru after a ransomware incident on 1 November 2024 compromised 182.7 GB of data, including personal details of 3,300 children. The attack exploited a 12‑year‑old account protected only by the weak password “Password1”. The ICO found breaches of GDPR Articles 28(4), 32(1)(b) and 32(1)(d) for both organisations. Both parties have since pledged remedial actions, including MFA and regular account reviews, and committed to a compliant data‑processing contract by 30 April 2025.

Why it matters

Any entity that maintains legacy accounts or outsources services must audit password strength and enforce multi‑factor authentication now, or risk similar ICO enforcement.

Business impact

Failure to secure legacy accounts can lead to large‑scale data breaches involving children’s data, triggering regulatory action and reputational damage.

Checklist

• Audit all user accountsHigh priority

  Identify and disable inactive or legacy accounts, especially those with weak passwords.

• Enforce strong password policiesHigh priority

  Require complex passwords and prohibit common passwords such as “Password1”.

• Implement multi‑factor authenticationMedium priority

  Apply MFA to all privileged and remote‑access accounts.

• Clarify security responsibilities in contractsMedium priority

  Ensure outsourced service agreements specify who manages account security and regular reviews.

Who reported it

Discussion