Hackers steal children's data after firm used 'Password1' to protect old account