英国信息专员办公室表示，一次网络攻击通过访问一个使用“Password1”作为密码的账户，窃取了数千名儿童的信息。
A cyber-attack stole information belonging to thousands of children by accessing an account that used the password "Password1", a data watchdog has said.
信息专员办公室（ICO）对Ogi Networks Limited（ONL）和Data Cymru作出谴责，此前于2024年11月1日发生了这起攻击。
The Information Commissioner's Office (ICO) has reprimanded Ogi Networks Limited (ONL) and Data Cymru after the attack on 1 November 2024.
黑客利用一个名为Test2的测试账户，泄露了3300人的个人信息，其中大多数是儿童。该账户已存在超过12年，其密码可在一秒内被破解。
The hackers exposed personal information belonging to 3,300 people, mostly children, by using a test account, known as Test2, which had existed for more than 12 years and was protected by the password that could be compromised in less than a second. ONL said the account "should have been removed long before criminals were able to use it", adding it had brought in independent cyber-security specialists.
ONL表示，该账户“本应在犯罪分子能够利用它之前很久就被移除”，并补充称已引入独立的网络安全专家。
The company, which provided IT services to Data Cymru, said it accepted the ICO's findings and had "acted on them".
这家为Data Cymru提供IT服务的公司表示，它接受信息专员办公室的调查结论，并已“据此采取行动”。已联系Data Cymru请其置评。
Data Cymru has been approached for comment. Both organisations were found to have breached UK GDPR rules by failing to properly protect their systems and by not regularly checking whether their security measures were effective.
这两家机构均被认定违反了英国《通用数据保护条例》（UK GDPR）的规定，原因是未能妥善保护其系统，也未定期检查其安全措施是否有效。
During the ransomware attack, the hackers encrypted 182.7GB of data and stole 42GB from Data Cymru's systems.
在这起勒索软件攻击中，黑客加密了182.7GB的数据，并从Data Cymru的系统中窃取了42GB数据。此次事件泄露了与两个支持儿童和家庭的项目相关的个人信息。
It exposed the personal information related to two projects supporting children and families. David Doodson, head of investigations at the Information Commission's Office, said: "Password1 is not an appropriate password, it is a wide-open door to nefarious actors.
信息专员办公室调查主管戴维·杜德森表示：“Password1不是一个合适的密码，它是一扇向不法分子敞开的大门。”
"This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands."
“这起事件表明，一个不再需要的账户上附带的单个弱密码，如何能留下一扇敞开的大门，导致可能影响数千人的严重网络攻击。”杜德森补充说，“这些失误”的责任“并不只在于某一家机构”。
Doodson added the responsibility for "these failures did not sit with one organisation alone". According to the watchdog, ONL created a test account in 2012 and used the password "Password1" to protect it, failing to audit it or remove it for more than 12 years.
据该监管机构称，ONL于2012年创建了一个测试账户，并使用“Password1”作为密码加以保护，在超过12年的时间里未能对其审计或将其移除。
It also did not review local administrator accounts after they were first deployed, with accounts on three affected systems using the same password, for the same period of time.
它还没有在首次部署后审查本地管理员账户，三个受影响系统上的账户在同一时间段内使用相同密码。
The watchdog said Data Cymru failed to put a data protection agreement in place with ONL, and that there was a gap in responsibility between the two organisations.
监管机构表示，Data Cymru未能与ONL建立数据保护协议，两个组织之间存在责任空白。
It also said Data Cymru failed to ensure the dormant test account was identified and removed, or updated to meet stronger password requirements.
它还表示，Data Cymru未能确保休眠测试账户被识别并移除，或更新以符合更严格的密码要求。
The ICO added it was a lesson for every organisation to "use strong passwords, protect remote access with multi-factor authentication, regularly review every user account, and be completely clear about who is responsible for cyber-security when services are outsourced".
信息专员办公室补充说，这对每个组织都是一个教训，应“使用强密码，通过多因素身份验证保护远程访问，定期审查每个用户账户，并在外包服务时明确谁负责网络安全”。网络攻击发生后，两个组织都引入了更强的安全措施。
Following the cyber-attack, both organisations introduced stronger security measures. ONL introduced a process prompting customers to review active accounts periodically and providing recommendations about accounts that should be removed, the ICO said.
信息专员办公室表示，ONL引入了一项流程，提示客户定期审查活跃账户，并提供关于应移除账户的建议。它还加强了账户访问控制，包括使用多因素身份验证。
It also strengthened its account access controls, including the use of multi-factor authentication. On 30 April 2025, Data Cymru and ONL entered into a legally compliant data processing contract.
2025年4月30日，Data Cymru和ONL签订了一份合法的数据处理合同。
Data Cymru also introduced periodic account reviews and strengthened account access controls, including using multi-factor authentication.
Data Cymru也引入了定期账户审查，并加强了账户访问控制，包括使用多因素身份验证。
A spokesperson for ONL said: "Within a week of the attack, we'd worked with Data Cymru to check every account on its network and switched off the ones it no longer needed that same day.
ONL的一位发言人说：“攻击发生一周内，我们与Data Cymru合作检查了其网络上的每个账户，并在当天关闭了不再需要的账户。
"We also brought in independent cyber-security specialists to investigate."
“我们还聘请了独立的网络安全专家进行调查。”他们补充说：“从那以后，我们通过多因素身份验证保护了远程访问，并为我们管理网络的客户引入了定期账户审查，以便找到并移除不再需要的账户。
They added: "Since then, we've protected remote access with multi-factor authentication and introduced regular account reviews for the customers whose networks we look after, so accounts that aren't needed are found and removed. "This was limited to the server we hosted for Data Cymru.
“这仅限于我们为Data Cymru托管的服务器。ONL持有的其他客户信息未受影响。”
No other customer information held by ONL was affected."