One Weak Password Exposed Thousands of Children's Records: Five Cyber Security Checks Every School Should Make
SchoolDPO INSIGHTS | 23 OCTOBER 2026 | 5-MINUTE READ
A recent ICO investigation offers an important reminder for Headteachers, School Business Managers, governors and academy trust leaders: protecting children's information requires more than good policies and an IT support contract.
On 20 October 2026, the Information Commissioner's Office (ICO) announced reprimands against two Welsh organisations following a ransomware attack that compromised personal information relating to approximately 3,300 people, most of them children.
The cause was remarkably simple: an old test account, created more than 12 years earlier, protected by the password Password1.
The account had either remained active or been inadvertently reactivated, creating an opportunity for attackers to gain access to systems holding sensitive information.
The incident demonstrates how a seemingly minor weakness in everyday IT management can have serious consequences.
What happened?
The attack involved Ogi Networks Limited and Data Cymru, two organisations responsible for aspects of the affected IT environment.
In November 2024, attackers exploited the weakly protected account during a ransomware attack. Approximately 42GB of data was taken from Data Cymru's systems, including information associated with projects supporting children and families.
The ICO identified shortcomings in account management, password security, oversight and contractual arrangements.
Importantly, responsibility was not confined to the IT supplier. The investigation found that both organisations had failed to establish sufficiently effective arrangements for identifying and removing unnecessary accounts.
For schools, this raises an important question:
If your IT provider manages your systems, how do you know that the appropriate safeguards are actually in place?
Five cyber security checks every school should make
1. Review old, unused and unnecessary accounts
Schools regularly experience staffing changes. Teachers leave, agency staff finish assignments, temporary employees move on and contractors complete projects.
But what happens to their accounts?
An account that is no longer needed should not remain active indefinitely. This includes test accounts, shared accounts and accounts created for temporary IT work.
Action: Ask your IT provider for confirmation that dormant and former-user accounts have been reviewed, and that unnecessary access has been removed.
The DfE recommends reviewing accounts with business or finance colleagues every term.
2. Check multi-factor authentication
Passwords alone are no longer sufficient protection for many school systems.
Multi-factor authentication (MFA) adds another verification step when someone signs in, helping protect accounts even if a password is compromised.
The DfE cyber security core standard requires MFA for staff accounts accessing cloud services or remote systems, as well as IT administrator accounts.
Action: Ask whether MFA is enabled across staff email, remote access, cloud services and administrator accounts. Any exceptions should be identified and addressed.
3. Know who has administrator access
Administrator accounts can have extensive control over school systems, including the ability to access or change sensitive information.
They should therefore be managed more carefully than ordinary staff accounts.
Schools should know who holds privileged access, why that access is necessary and when it was last reviewed.
Action: Request an up-to-date register of privileged accounts, including accounts held by external IT providers.
4. Be clear about your IT provider's responsibilities
Outsourcing IT support does not remove a school's own data protection responsibilities.
The ICO case demonstrated how unclear arrangements between organisations can create significant security gaps.
Schools should understand who is responsible for account creation and deletion, security monitoring, incident response, backups and access reviews.
Where an IT supplier processes personal data on the school's behalf, appropriate contractual data protection provisions are also required.
Action: Review your IT support agreement and ask your provider to confirm how security responsibilities are allocated, monitored and evidenced.
5. Test your incident response and backup arrangements
Even well-managed systems can experience cyber incidents.
The important question is whether the school is prepared to respond effectively.
Schools should know who to contact, what to do if systems become unavailable, how incidents will be assessed and whether information can be recovered from backups.
Action: Ask when your school last tested its backup restoration process and reviewed its cyber incident response plan.
The DfE recommends reviewing cyber response plans at least annually, alongside routine account, software and security checks.
SchoolDPO's five-point cyber security assurance checklist
Use this simple table at your next leadership, governance or IT review meeting.
This need not become a complicated exercise. A short, documented conversation with your IT provider could identify issues that might otherwise remain unnoticed.
Why this matters for safeguarding
Cyber security and safeguarding are increasingly connected.
Schools hold significant amounts of personal information about children and families, including safeguarding records, SEND information, medical details and family circumstances.
A security incident can therefore create risks that extend beyond financial loss or disruption to teaching.
The DfE's updated filtering and monitoring standards also emphasise the importance of clear responsibilities, effective oversight and documented checks. 
Cyber security should not be viewed solely as a technical matter. It is part of the school's wider arrangements for protecting children and maintaining public confidence.
How SchoolDPO can help
At SchoolDPO, we help schools turn data protection requirements into practical, proportionate arrangements that work in everyday school life.
That includes reviewing data protection policies and supplier arrangements, advising on information governance, supporting responses to personal data breaches and helping leaders identify areas where further assurance is needed.
We do not replace your IT provider. Instead, we help you ask the right questions, understand the evidence and make informed decisions about the protection of personal information.
Our advice this week is simple: don't just ask whether your school has cyber security arrangements. Ask when they were last checked, what was found and what happened next.
If you would like help reviewing your school's data protection and cyber security governance arrangements, contact SchoolDPO.
Further reading
1. Information Commissioner's Office (ICO) – Password1 cyber security case
2. Department for Education – Cyber Security Core Standard
3. Department for Education – Cyber Security Hub: Back to School
Comments