Denmark Data Breach Involving 8.8 Million Records Linked to ‘123456’ Password
A weak password at Danish firm Pays ApS exposed about 8.8 million CPR records, including ID numbers and addresses.
Politiken reported that Pays ApS, a small IT company in Odense, had its authorized access to Denmark's Central Person Register abused after accounts, including an administrator, used the password 123456. An alleged attacker provided 8,749,975 records covering about 5.5 million living people and 3.3 million deceased people, including CPR numbers and addresses. The attacker said a former employee's leaked password enabled access starting September 10 for roughly three weeks, while authorities separately described about ten days of access. Pays confirmed the abuse; MitID was not reported compromised, and no fraudulent use of the records is confirmed.