Hacker Uses ‘123456’ Password to Breach Denmark’s National Population Database

A significant data breach has been reported in Denmark, resulting in the exposure of personal data for roughly 8.8 million individuals. The perpetrator of the breach claimed they exploited the country's national population database using the remarkably insecure password "123456." The intrusion targeted Denmark's Central Register of Persons (CPR), a database housing sensitive information such as names, addresses, and identification numbers.

According to Danish publication Politiken, the hacker infiltrated the system by accessing an account associated with Pays ApS, a private IT firm permitted to utilize the national database to validate customer data for businesses. The article stated that at least three of Pays ApS' accounts, including an administrator account, were configured with the identical password. Sophie Laursen, managing director of Pays ApS, affirmed on October 9 that the company's utilization of the database had been compromised.

The cyber intrusion was detected on October 2 following a government employee's notice of an invoice revealing an unexpectedly high level of activity tied to the company. Danish authorities confirmed the breach on October 5, stating that the compromised data comprised around 8.8 million people. The national database houses approximately 11 million records, encompassing the deceased and those who have emigrated.

The individual claiming responsibility for the breach informed Politiken that they had no intention of selling or disseminating the stolen data. However, authorities have yet to corroborate the claim regarding the password utilized in the breach. The Danish Data Protection Agency was informed of the incident on October 4, one day prior to the official government announcement. Subsequently, authorities have severed Pays ApS' access to the database, and law enforcement is currently probing the breach.