‘Basic steps’ including updating passwords were missed before 2021 hack, finds Information Commissioner