How “123456” became the key to almost 9 million personal records
Attackers used the password 123456 to query Denmark’s CPR register, exposing records on about 8.8 million people.
Attackers abused Pays ApS’s authorized access to Denmark’s civil population register using a former employee’s leaked password, 123456, which had appeared in an earlier data leak. Over 21 days they ran about 14 million searches, obtaining names, addresses, and CPR numbers for roughly 5.5 million living and 3.3 million deceased people. Suspicious querying stopped on September 20 and access was shut down on October 2 after an unusually large bill drew attention.
88