'123456' password linked to Denmark data breach affecting 8.8M people
Local media reports three weakly protected accounts at small IT biz whose access to national register was abused
The Central Register of Persons (CPR) in Denmark experienced a data breach on October 5, compromising the information of 8.8 million individuals. An IT company's account, protected by the password 123456, was allegedly the entry point for the breach. The intruder, claiming responsibility, did not intend to sell or leak the data.
Danish news outlet Politiken reported that multiple company accounts, including an administrator account, shared the same password. The Danish CPR administration confirmed the breach, attributing it to unauthorized access granted by the company Pays ApS. The company's website was subsequently taken offline, and it has yet to respond to inquiries regarding the password incident.
The breach involved approximately 11 million records, covering deceased individuals and those who have migrated abroad. The intrusion began on September 10 and continued until September 20, with 14 million automated searches. The attack was identified on October 2, 12 days after the final reported searches. The Danish data protection authority, Datatilsynet, was alerted on October 4, and the government disclosed the breach on the following day.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
