Roughly 8.8 million individuals in Denmark had their personal data exposed in a major data breach after an attacker reportedly breached the national population database using the basic password 123456.
Denmark's Central Register of Persons, known as the CPR, acts as the repository for sensitive details such as names, identification numbers, and home addresses.
Politiken, a Danish newspaper, stated that the intruder supposedly broke in via a credential set belonging to Pays ApS. This private technology firm holds authorization to check customer data for commercial clients using the state system.
At least three profiles at the firm, featuring an administrator profile, shared that identical password, the publication noted. Sophie Laursen, who serves as Managing Director of Pays ApS, verified on October 9 that unauthorized parties abused their system connection.
TV 2, a Danish broadcaster, secured records showing the culprit executed approximately 14 million automated queries spanning from September 10 to September 20.
A state worker spotted a bill displaying abnormal transaction volumes tied to the business, leading to the discovery of the security failure on October 2.
Officials in Denmark verified the event on October 5, stating that the compromised data impacted roughly 8.8 million living and past citizens. The total state repository holds about 11 million files, which encompasses individuals who relocated abroad or passed away.
The individual asserting responsibility told Politiken they hold no intention to publish or trade the pilfered data. Still, officials have not verified statements regarding the specific password employed during the intrusion.
Notification was given to the Danish Data Protection Agency on October 4, which preceded the public announcement by the government by a single day.
State officials have revoked the firm database privileges since the discovery, and police forces are currently probing the incident.
