Password '123456' Blamed for Denmark Data Breach Exposing 8.8 Million People

A breach of Denmark's Central Register of Persons (CPR) affected the information of 8.8 million people. The person claiming responsibility told Danish outlet Politiken they got in through an IT company's account protected by the password "123456". The newspaper reported that at least three company accounts, including an administrator account, used the same password. Authorities have not commented on the alleged password failings.

Danish authorities confirmed on October 5 that a company's legal access to the CPR system had been abused. Funen-based Pays ApS, which had authorised access to validate business customers' records, was not named by officials, but its managing director confirmed on October 9 that its access had been exploited. The company's website has been taken offline. According to documents obtained by broadcaster TV 2, the attacker gained access on September 10 and ran 14 million automated searches by September 20. The person told Politiken they had no intention of selling or leaking the data.

The intrusion was only detected on October 2, 12 days after the last reported searches. A department staffer noticed an invoice showing unusually high activity from Pays. The data protection authority was notified on October 4, and the government disclosed the incident the next day. The case shows how a small supplier with trusted access to sensitive systems can become the weak point for a much larger organisation.