United KingdomIn November 2024, a ransomware attack affected two Welsh organizations, broadband provider Ogi Networks Limited (ONL) and the Welsh local government data unit, Data Cymru, after a test account named 'Test2' was secured with the weak password 'Password1'. The Information Commissioner’s Office (ICO) later reprimanded both entities for violating GDPR regulations. The account, which had been active since 2012, was reportedly reactivated accidentally or left enabled, allowing cybercriminals to steal data from 3,300 individuals, primarily children. The breach involved 182.7GB of encrypted data, with 42GB coming from Data Cymru's systems. Following the incident, both organizations implemented stronger security measures, such as multi-factor authentication and periodic account reviews. The ICO emphasized that the failure stemmed from poor password practices and inadequate oversight of inactive accounts.
Bias read (Center): The article focuses on a cybersecurity incident involving weak passwords and data breaches, with no direct political implications or partisan framing. It provides factual details about the breach, the organizations involved, and the regulatory response without showing bias toward any political side.
