'123456' password linked to Denmark data breach affecting 8.8M people

Local media reports three weakly protected accounts at small IT biz whose access to national register was abused

A person claiming responsibility for the breach of Denmark's Central Register of Persons (CPR) says they gained access through an IT company's account protected by the password "123456."

The person told Danish news outlet Politiken they had no intention of selling or leaking the data. The newspaper reported that at least three company accounts, including an administrator account, used the same password.

Denmark's CPR administration confirmed a breach affecting the information belonging to 8.8 million people on October 5, adding that a Danish company's legal access to the CPR system was abused.

REG AD

It did not name Funen-based Pays ApS as the company in question, but managing director Sophie Laursen confirmed on October 9 that it's access had been exploited.

REG AD

Pays' website has been taken offline, and the business has not responded to The Register's request for more information about the password claims.

Pays had authorized access to the CPR system to provide services such as validating business customers' records.

The Danish government says information relating to 8.8 million people was accessed. The register contains approximately 11 million records, including those of deceased people and people who have moved abroad. The government did not respond to questions about the alleged password failings.

According to documents obtained by broadcaster TV 2, the attacker gained access to the CPR system on September 10 and ran the 14 million automated searches between then and September 20.

The intrusion was detected on October 2, 12 days after the last reported searches.

Mikkel Leihardt, director of the government's higher education and science ministry, told reporters at a press conference that the attack was discovered after a department staffer picked up an invoice indicating unusually high activity from Pays.

The Danish data protection authority, Datatilsynet, was notified on October 4, and the government disclosed the attack the following day. ®