A widely used and incredibly simple password, '123456', is reportedly all it took for a hacker to gain access to Denmark's Central Register of Persons (CPR) and expose the personal data of approximately 8.8 million individuals. The breach, which occurred in September, compromised sensitive information including names, addresses, and identification numbers of both living and deceased citizens.
The attacker, who has come forward claiming responsibility, stated they exploited a legitimate account belonging to a private Danish firm, Pays ApS, which had been secured with the easily guessable password. According to Danish newspaper Politiken, this was one of three accounts managed by the firm using '123456' as the password, with one of those accounts being an administrator-level credential.
Pays ApS had been granted access to the CPR to perform various services, such as validating business customer records. The self-identified hacker claims to have accessed the account on September 10 and subsequently conducted approximately 14 million automated searches of the CPR database until September 20. The breach was only discovered on October 2 after an employee at the Ministry of Research, Education and Digitalisation noticed an unusually high invoice, indicating excessive activity by Pays ApS.
The attacker has stated they have no intention of leaking or selling the compromised data. Nevertheless, the incident serves as a stark reminder of the critical importance of robust password security practices. Common passwords, including '123456', are frequently targeted by malicious actors, and their continued prevalence underscores a significant cybersecurity vulnerability.
This event highlights a recurring issue in cybersecurity, where basic password hygiene is often neglected. While sophisticated hacking often involves advanced techniques and powerful hardware, the '123456' case demonstrates that even the most rudimentary vulnerabilities can lead to devastating data exposures. Users are advised to update their passwords to unique and complex combinations, or to consider using reputable password management tools, though even these are not entirely immune to potential weaknesses.