'123456' password was all a hacker reportedly needed to expose over 8 million people's personal data
A department where just a little bit of creativity doesn't go amiss.
Denmark's Central Register of Persons (CPR) suffered a security breach in September, exposing personal information of 8.8 million individuals. Although the attacker claimed no intention of leaking or selling the stolen data, the incident highlights the vulnerability of using weak passwords. The private Danish firm Pays ApS, which had access to CPR for various services, was the target of the breach.
The attacker gained entry through an administrator account with the password '123456', one of three accounts held by the firm with the same password. Once inside, the attacker conducted 14 million automated searches of the CPR between September 10 and September 20. The breach was discovered on October 2 when an employee noticed an unusually high invoice, indicating numerous searches beyond the norm.
This incident serves as a reminder for everyone to strengthen their password management practices and avoid using simple passwords like '123456'.
Written by urgent.news from PC Gamer's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
