Two Welsh organisations reprimanded after cyber-attack exposed children’s information