Welsh organizations reprimanded by ICO after weak passwords lead to data breach

The Information Commissioner's Office reprimanded two Welsh organizations after a ransomware attack led to the theft of personal data belonging to 3,300 individuals, DataBreaches.net, North Wales Live, Wired Gov, The Register, and Wales Online all reported. The vast majority of the compromised records belonged to children. [1][2][3][4][5]

DataBreaches.net and The Register reported that the cyber attack was enabled by severe password vulnerabilities, including the use of simple credentials such as Password1 and an unmonitored test account named Test 2. Hackers exploited these weak security practices to gain access to the systems. [1][4]

Common passwords like Password1 carry low password strength and are frequently discovered during data breaches. Hacking remains the most frequent method used by intruders to compromise organizational records. [6][7]

The enforcement action by the Information Commissioner's Office serves as an official reprimand against the two entities for failing to protect sensitive personal data, Wired Gov and DataBreaches.net reported. [1][3]