In Wales, the personal data of thousands of children and their families was compromised following a ransomware attack. The UK Information Commissioner's Office (ICO) investigation found that the attackers infiltrated the network of Data Cymru, an organization funded by the Welsh government, by exploiting an account with the weak password 'Password1'. Ogi Networks Limited (ONL), the IT service provider for Data Cymru since 2012, was also implicated in this security failure. The breach occurred when attackers accessed a test account named 'Test 2', which had been active for over 12 years. This account's inadequate password allowed the attackers to penetrate Data Cymru's network, encrypting 182.7GB of data and extracting 42GB of sensitive information. This data pertained to projects supporting children and families and affected 3,300 individuals, most of whom were children. The ICO reprimanded both Data Cymru and ONL for violating UK GDPR regulations. Data Cymru was particularly criticized for lacking a proper contract with ONL that specified data protection requirements and for failing to conduct comprehensive account reviews. Although neither organization faced financial penalties, the ICO acknowledged corrective measures taken post-incident, such as implementing stronger access controls and establishing a compliant data processing contract. David Doodson of the ICO emphasized the necessity of robust cybersecurity practices, including strong passwords, multi-factor authentication, and routine account reviews, especially when services are outsourced.