The password ‘123456’ was the only thing standing between the hacker and the data of 8.8 million people
- Attackers reportedly accessed Denmark’s population registry through a third-party company using weak credentials.
- Approximately 8.8 million people’s data may have been exposed, including CPR ID numbers
- The breach highlights serious third-party security flaws, with reports citing passwords as “123456”
The data held by the Danish national population register was supposedly protected by a very secure and very difficult to crack password: 123456.
This claim was made by a person who allegedly broke into the registry in September 2026, accessing data of 8.8 million people.
Might as well be without a password
The Danish Central Register of Persons (CPR) is the country’s national population register that maintains identifying information about people living in Denmark, including their names, addresses, dates of birth, citizenship and marital status.
Latest videos ofTechnologyRadar
Each individual is assigned a unique 10-digit CPR number that is widely used in healthcare, tax, banking, and more.
In a press release, CPR revealed that someone gained unauthorized access to its systems by “abusing a Danish company’s legal access to search the CPR system for information.”
He explained that private companies with a legitimate interest can obtain CPR information about “a larger, more limited group of people whom the company has individually identified in advance.”
So this was a supply chain attack, in which someone accessed the names, addresses, CPR numbers and other details of approximately 8.8 million people, through a privately owned third party. What’s also interesting is that, according to Worldometer, the entire Danish population numbers just over six million people, but CPR says it has about 11 million records, including those who have died and those living abroad.
The initial press release did not say who the attacker was or what company was targeted in the attack. He said the investigation was still ongoing and CPR took steps to strengthen its security posture. However, Danish media discovered that the attack occurred via Funen-based Pays ApS, a fact that was later confirmed by CEO Sophie Laursen.
Pays was authorized to access the CPR system and the intrusion was detected when, late in the month, a government employee saw an unusually high activity log from Pays over the previous month. Local television station TV 2 said the attacker performed 14 million automated searches in ten days. Meanwhile, Pays’ website was taken offline. However, at the time of going to press, it was working normally.
“Really shocking”
The story gets even better. Local publication Politiken claims to have spoken to the attacker via an encrypted chat service. The threat actor, who was not named, said he used the login credentials of a former employee, whose password was “123456.” After logging in, they created two scripts to extract CPR information and send it to a third-party system.
Three separate accounts were allegedly found, all using the same simple password. The threat actor confirmed that they have no intention of leaking or selling the stolen data, adding that they were “really surprised” by how poor the security posture was.
“Someone leaves a suitcase with 10 kilos of plutonium unattended at a train station and then a homeless man steals it,” the hacker said. “Yes, of course you shouldn’t steal other people’s suitcases. But you shouldn’t leave nuclear material at a train station either.”
The threat actor provided a file with CPR numbers to the publication and the media confirmed its authenticity with the help of independent cybersecurity researcher Emil Hørning. The investigator said the threat actor’s account “seemed credible” and that the methods he described were “plausible.”
While it is commendable to have no intention of selling or leaking the data, we can’t help but notice that the threat actor made no mention of using the data. Names, addresses, dates of birth, as well as CPR numbers used in healthcare, taxes or banking – all of this is very valuable information that can be used in highly personalized phishing attacks that can lead to ransomware infections and phishing.
Through The Registry
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment