One of the world's worst passwords, 123456, helped a hacker steal 8.8 million people's data in Denmark

Denmark's Central Register of Persons (CPR) experienced a data breach in September, resulting in the exposure of personal information for 8.8 million individuals, including both living and deceased residents. The hacker gained unauthorized access through an IT company whose credentials utilized the notoriously weak password 123456.

This password was among the most commonly used, appearing ten times in last year's top 20 list of most common passwords. The hacker, who did not intend to sell or leak the stolen data, exploited the company's authorized access to CPR systems to conduct 14 million automated searches between September 10 and September 20. The breach was discovered by a Ministry of Research, Education, and Digitalisation employee who noticed an unusual spike in Pays ApS, the targeted company's, search activity.

Pays ApS, which provides services like validating business customers' records using CPR systems, confirmed the breach and subsequently took down its website. The hacker claimed no intention to capitalize on the stolen information. This incident is not the first time a company with sensitive data has been compromised using the 123456 password; researchers previously accessed a McDonald's McHire recruitment platform using the same password.