Hacker claims ‘123456’ password let them breach the Danish national registry, accessing 8.8 million records
The Danish Central Register of Persons (CPF) was breached through the account of an IT and data services business. The hacker claimed that one of the breached accounts was only protected by a '123456' password.
A hacker responsible for the recent breach of Denmark’s national registry claims the weak password "123456" allowed them to access 8.8 million records. The IT company Pays ApS provided the access point, as one of the breached accounts was protected only by the simple password. The breach went undetected for 12 days until an unusual spike in activity was detected on an invoice.
Denmark’s government confirmed the hack and stated that it took place through Pays ApS. Pays ApS managing director Sophie Laursen confirmed the use of the database to exfiltrate the data. The incident highlights the vulnerability of systems relying on weak passwords, as the government database’s security was breached through a third-party user’s poor password choice.
Despite containing nearly every citizen’s personal data, the CPR database should have required stronger passwords, including two-factor authentication. This event follows other instances where government databases have been compromised due to inadequate protection, such as the 2024 Indonesian ransomware attack affecting over 230 public agencies and the 2023 South Korean data loss following a catastrophic fire at a government data center.
Experts predict that the Danish government will soon implement stronger password policies, particularly given the increasing ease with which AI can aid hackers. Recent attacks against South Korean banks, the Taiwanese government, and OpenAI have all benefited from AI tools, underscoring the escalating threat AI poses to cybersecurity.
However, the hacker’s reliance on a password like "123456" suggests that even the simplest password could suffice for those with malicious intent.
Written by urgent.news from Tom's Hardware's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
