As reported by Infosecurity Magazine, a significant data breach involving the personal information of thousands of children and their families occurred in Wales due to inadequate security measures.
The Information Commissioner's Office, the United Kingdom's data regulator, issued a reprimand to Ogi Networks Limited and Data Cymru following a November 2024 ransomware attack. Attackers gained access to the network through a test account protected by the weak password 'Password1'. This account had remained active for over 12 years without proper oversight. The breach resulted in the encryption of 182.7 gigabytes of data and the exfiltration of 42 gigabytes of sensitive information, affecting 3,300 individuals. Investigations revealed that Ogi Networks Limited failed to enforce password complexity requirements or conduct regular account audits. Simultaneously, Data Cymru lacked a formal contract with its service provider and failed to perform routine security reviews. While no financial penalties were issued, the Information Commissioner's Office emphasized that organizations must implement multi-factor authentication and maintain strict control over user accounts. Both entities have since taken remedial actions to strengthen their security posture and ensure compliance with data protection legislation. The incident serves as a stark reminder of the risks associated with basic cybersecurity failures in outsourced IT environments.
Source: Infosecurity Magazine
