Hackers Steal 8.8 Million Danish Records Using Simple 123456 Password
The breach targeted Denmark's Central Register of Persons (CPR) which stores PII including full names, addresses, and individual identification numbers. While the national database itself maintains strict infrastructure, the weak link here was from a third-party partner that was granted legitimate API access. According to The Register, private Danish IT and data services firm Pays ApS was the entry point for the attack as it utilizes the CPR database to validate business customer records, but someone at Pays ApS apparently fell asleep during cybersecurity training.
The self-identified hacker revealed that they gained access to the database via a Pays ApS account that was secured by "123456" as the password (wah-wah). Reports indicate that the firm had altogether three accounts with this same password, one of which was administrator-level (double wah-wah). In short, the intruder breached the system on September 10 and executed approximately 14 million automated searches across the CPR database over a 10-day span.
Managing director Sophie Laursen confirmed that the hacker had indeed leveraged the firm's access to extract the records. While the hacker (or hackers) responsible claims they have no intention of selling or publicly leaking the stolen records, the fallout is no doubt embarrassing for the Danish government, but should be a strong reminder to all countries: central databases are only as secure as the weakest third-party vendor granted access to it. At a time when cyber threats and AI hacking are dominating security headlines, one can not stress enough the basic importance of strong and frequent password hygiene at all levels of the chain.
