Science & Tech · Cybersecurity · 2 hrs ago
Weak password claims surface in Denmark breach affecting 8.8 million people
Denmark says a breach exposed information on 8.8 million people in its Central Register of Persons, known as the CPR.
The register holds about 11 million records, including records for people who have died or moved abroad.
A person claiming responsibility said access came through an IT company's account protected by the password “123456.”
Pays ApS, a Danish company authorized to use CPR data to verify business customers, confirmed its access had been exploited.
Documents obtained by Danish broadcaster TV 2 indicate the attacker made 14 million automated searches from September 10 to September 20.
The intrusion was detected on October 2, after a government staff member noticed an invoice showing unusually high activity.
The government disclosed the breach on October 5, and the data protection authority was notified the day before.
Denmark’s Central Register of Persons was breached, affecting information belonging to 8.8 million people.
A person claiming responsibility told Politiken they accessed the register through an IT company account protected by the password “123456.”
The Danish government said a company’s legal access to the register had been abused but did not name the company.
Pays ApS managing director Sophie Laursen confirmed on October 9 that the company’s access had been exploited.
Documents obtained by TV 2 indicate the attacker ran 14 million automated searches between September 10 and September 20.
- Who
- A person claiming responsibility for the breach; a Danish company’s access to the register was abused.
- What
- Information belonging to 8.8 million people was accessed. The person said they used an account protected by “123456.
- When
- The attacker reportedly accessed the system from September 10 to September 20. The breach was detected on October 2 and disclosed on October 5.
- Where
- Denmark’s Central Register of Persons.
- Why
- The person claiming responsibility said they had no intention of selling or leaking the data. The reason for the breach is not stated.
This story does not have two clearly opposing sides.
The attacker reportedly gained access to the CPR system.
The reported period of automated searches ended, after 14 million searches.
The intrusion was detected after a government department staffer noticed an invoice indicating unusually high activity from Pays.
The Danish data protection authority was notified.
The government disclosed the breach, saying information belonging to 8.8 million people had been accessed.
Pays ApS managing director Sophie Laursen confirmed that the company’s access had been exploited.
- People affected
- 8.8 million
- Automated searches
- 14 million
- Register
- Denmark’s Central Register of Persons
- Company identified in reporting
- Pays ApS
- Password reported
- 123456
What people are saying
123456
Sources
Related news
Ahold Delhaize takes some systems offline after cyberattack
Cyberattack overheats refrigeration systems in hundreds of French supermarkets
Cyberattack Defrosts Refrigerators at Hundreds of French Supermarkets
Cyberattack disrupts systems at TFG’s three UK fashion brands
GitLab urges self-managed users to patch critical code execution flaw
Ridge Security launches on-site AI penetration testing system
French supermarket hack raises concerns about smart home devices
Hackers take control of cooling units at 350 French supermarkets
Canadian cybersecurity executive arrested on federal extortion charges
