ICO fines Ogi Networks and Data Cymru over weak password breach

What happened

• The UK Information Commissioner's Office (ICO) issued enforcement notices to Ogi Networks Limited and Data Cymru after a ransomware incident on 1 November 2024 compromised 182.7 GB of data, including personal details of 3,300 children.
• The attack exploited a 12‑year‑old account protected only by the weak password “Password1”.
• The ICO found breaches of GDPR Articles 28(4), 32(1)(b) and 32(1)(d) for both organisations.
• Both parties have since pledged remedial actions, including MFA and regular account reviews, and committed to a compliant data‑processing contract by 30 April 2025.

Why it matters

Any entity that maintains legacy accounts or outsources services must audit password strength and enforce multi‑factor authentication now, or risk similar ICO enforcement.

Business impact

Failure to secure legacy accounts can lead to large‑scale data breaches involving children’s data, triggering regulatory action and reputational damage.

What to check

1. 1

   Audit all user accountsHigh priority

   Identify and disable inactive or legacy accounts, especially those with weak passwords.

2. 2

   Enforce strong password policiesHigh priority

   Require complex passwords and prohibit common passwords such as “Password1”.

3. 3

   Implement multi‑factor authenticationMedium priority

   Apply MFA to all privileged and remote‑access accounts.

4. 4

   Clarify security responsibilities in contractsMedium priority

   Ensure outsourced service agreements specify who manages account security and regular reviews.