A watchdog revealed that cybercriminals were able to steal the information of thousands of children after only the passcode 'Password1' was used on an account