'123456' password reportedly used in Danish data breach affecting 8.8 million people

A person claiming responsibility for the breach of Denmark's Central Register of Persons told Danish outlet Politiken they gained access through an IT company's account protected by the password "123456," and said they had no intention of selling or leaking the data. Politiken reported that at least three company accounts, including an administrator account, used the same password.

The CPR administration confirmed on October 5 that a breach had affected information belonging to 8.8 million people, saying a Danish company's legal access to the system had been abused. It did not name Funen-based Pays ApS, but managing director Sophie Laursen confirmed on October 9 that the company's access had been exploited. Pays' website has been taken offline, and the business has not responded to The Register's request for more information about the password claims.

Pays had authorized access to the CPR system to provide services such as validating business customers' records. The register contains approximately 11 million records, including those of deceased people and people who have moved abroad. The Danish government did not respond to questions about the alleged password failings.

According to documents obtained by broadcaster TV 2, the attacker gained access on September 10 and ran 14 million automated searches between then and September 20. The intrusion was detected on October 2, 12 days after the last reported searches. Mikkel Leihardt, director of the government's higher education and science ministry, told reporters the attack was discovered after a department staffer picked up an invoice indicating unusually high activity from Pays.

The Danish data protection authority, Datatilsynet, was notified on October 4, and the government disclosed the attack the following day.

Analysis

Why This Matters

The breach exposed personal information of 8.8 million people, a population larger than Denmark's, demonstrating the scale of damage possible from a single weak credential.
If confirmed, the "123456" password points to basic security hygiene failures in a system holding sensitive government records.
Twelve days passed between the last detected activity and the discovery of the intrusion, raising questions about monitoring practices.

Background

Denmark's Central Register of Persons is a government database holding personal information on residents. Companies can be granted legal access for legitimate services such as verifying customer records, which is the access route allegedly abused here. Weak passwords such as "123456" remain among the most common credentials found in breach databases and are trivial for automated tools to guess.

Key Perspectives

The attacker: Claimed responsibility, told Politiken access was gained via the "123456" password, and said there was no intention to sell or leak the data. Pays ApS: Managing director Sophie Laursen confirmed the company's access was exploited; the company's website has been taken offline and it has not responded to further questions. Danish government: Confirmed the breach affecting 8.8 million people and said a company's legal access was abused, but did not respond to questions about the password claims or name the company itself. Critics/Skeptics: The delay between the intrusion and its detection, and the reliance on an invoice rather than security systems, may prompt scrutiny of how registered access is monitored.

What to Watch

Whether Pays or the government publish findings confirming the password claim.
Any regulatory action by Datatilsynet regarding the security of the access arrangement.
Whether the attacker's stated intention not to leak or sell the data holds, and whether any of the accessed information surfaces publicly.

Analysis

Why This Matters

Background

Key Perspectives

What to Watch

Sources