In 2024, a significant cybersecurity breach occurred involving Ogi Networks Limited and Data Cymru, resulting in the unauthorized access of sensitive data, including information belonging to children. Following an investigation into the incident, the Information Commissioner’s Office (ICO)—the UK’s data protection regulator—issued a formal reprimand to both organizations.

The investigation revealed that the breach was facilitated by poor security practices. Specifically, the attackers gained access through an old, inactive account that was protected by the extremely weak password 'Password1'. This failure to implement basic security measures, such as robust password policies and the decommissioning of unused accounts, allowed unauthorized parties to compromise the network.

While the organizations have been reprimanded, the incident highlights ongoing concerns regarding how companies store and protect the data of minors. The ICO emphasized that the failure to secure such data constitutes a breach of regulatory standards. Both Ogi Networks and Data Cymru are now expected to overhaul their security protocols to prevent future occurrences. The incident serves as a reminder of the risks posed by 'legacy' accounts—old accounts that are often forgotten by IT departments but remain connected to active networks, providing an easy entry point for cybercriminals.