ICO Criticizes Welsh Council Over Ransomware Breach That Exposed Children’s Records

The UK Information Commissioner’s Office (ICO) has issued a scathing assessment of security shortcomings after a ransomware attack on a Welsh local government data unit and its IT service provider led to the theft of personal information belonging to children.

The breach, which came to light in early 2024, involved the compromise of an account protected only by the generic password "Password1". Attackers used the weak credentials to infiltrate the system, extract data and then encrypt files, demanding a ransom that the council ultimately refused to pay.

According to the ICO’s preliminary report, the local authority failed to implement basic safeguards such as multi‑factor authentication, regular password rotation and robust encryption of sensitive records. The regulator highlighted that the data unit stored school enrollment details, health information and contact data for minors, making the exposure especially serious under the UK’s data protection laws.

Welsh officials have confirmed that the stolen data includes names, dates of birth and home addresses of several thousand children, though the exact number remains unverified. The ICO warned that the lack of adequate controls not only breached the General Data Protection Regulation (GDPR) but also eroded public confidence in how local authorities manage digital services.

In response, the council has pledged to overhaul its cybersecurity framework, appointing an external specialist to conduct a full forensic audit and to roll out mandatory two‑step verification for all privileged accounts. The IT service provider involved has also been placed under scrutiny, with the ICO indicating that contractual obligations around data security may be reviewed.

The incident arrives amid a broader rise in ransomware targeting public sector bodies across the UK, prompting calls for a coordinated national strategy. The ICO’s findings could lead to enforcement action, including possible fines, and serve as a cautionary tale for other municipalities that rely on legacy systems and outdated password policies. As investigations continue, affected families are being notified and offered guidance on protecting their children’s identities moving forward.