Ogi Networks and Data Cymru Reprimanded After Ransomware Attack Exposes Children's Data
Children's personal data was compromised in a 2024 ransomware attack that exploited a weak password, 'Password1', used by a third-party contractor, Data Cymru. The breach affected Ogi Networks Limited, which had commissioned Data Cymru to develop an app for its 'Gigabit-full fibre' broadband service. The Information Commissioner's Office (ICO) has issued a reprimand to both organisations for their failings in data protection.
The compromised data, stored on an old server that Data Cymru had reportedly failed to decommission, included names, addresses, and dates of birth of children who had participated in a competition. The ICO's investigation concluded that both Ogi Networks and Data Cymru breached UK GDPR regulations, specifically Article 5(1)(f) concerning security of processing and Article 32 regarding security of processing.
Ogi Networks initially engaged Data Cymru in 2021 to develop a competition app targeting children aged between six and fourteen. The competition, which ran in 2022, involved children submitting drawings or poems to win prizes such as iPads. Data Cymru confirmed the incident occurred in April 2024, reporting the breach to the ICO the following month.
The ICO determined that Data Cymru had not sufficiently secured the server containing the children's data and failed to delete it once it was no longer needed. Ogi Networks was also found negligent for not implementing appropriate due diligence and oversight of its contractor's data handling practices. The regulator highlighted the particular vulnerability of children's data, underscoring the necessity for robust security measures in such operations.
