Danish registry breached using password 123456, exposing millions of records

A hacker breached Denmark's national civil registry by entering the password 123456 into a legitimate account belonging to company Pays ApS. The attacker remained undetected inside the government system for ten days starting September 10.

The CPR registry holds about 11 million records, including deceased individuals. Source BGR reports that sensitive information on 11 million citizens was exposed, while Que! states that data on 8.8 million people was left uncovered.

“Six digits opened the door to 8.8 million people.”

During the intrusion, the hacker carried out 14 million searches over ten days. The breach was discovered on October 2 and confirmed by CPR administration on October 5.

The intrusion was noticed after a ministry employee saw an unusually high charge from Pays ApS on an invoice, not through a firewall alert. At least three Pays ApS accounts, including an administrator account, reportedly shared the same password, though neither the company nor the administration confirms this.

The incident shows that advanced firewalls and encryption cannot protect data when the front door is left open with a weak password.