'123456' password linked to Denmark data breach affecting 8.8M people
A "123456" password on a vendor account exposed Denmark's register data on 8.8 million people.
Denmark confirmed that legal access held by a Danish company to the Central Register of Persons was abused, exposing information on 8.8 million people. A person claiming responsibility told Politiken they used an IT-company account protected by the password "123456"; the paper reported at least three accounts, including an administrator account, used that password. Pays ApS managing director Sophie Laursen confirmed the company's access was exploited. Documents obtained by TV 2 say access began September 10 and about 14 million automated searches ran through September 20, with detection on October 2. Datatilsynet was notified October 4. The claimant said they did not intend to sell or leak the data.
- CPR data on 8.8 million people was accessed via abused legal access.
- A claimant told Politiken the account password was 123456.
- At least three Pays ApS accounts, including an admin account, allegedly shared it.
- About 14 million automated searches ran from September 10 to 20.
- Intrusion was found October 2 after an unusually high activity invoice.
Full article327 words · extracted from theregister.com · click to collapse
security
Local media reports three weakly protected accounts at small IT biz whose access to national register was abused
A person claiming responsibility for the breach of Denmark's Central Register of Persons (CPR) says they gained access through an IT company's account protected by the password "123456."
The person told Danish news outlet Politiken they had no intention of selling or leaking the data. The newspaper reported that at least three company accounts, including an administrator account, used the same password.
Denmark's CPR administration confirmed a breach affecting the information belonging to 8.8 million people on October 5, adding that a Danish company's legal access to the CPR system was abused.
REG AD
It did not name Funen-based Pays ApS as the company in question, but managing director Sophie Laursen confirmed on October 9 that it's access had been exploited.
REG AD
Pays' website has been taken offline, and the business has not responded to The Register's request for more information about the password claims.
Pays had authorized access to the CPR system to provide services such as validating business customers' records.
The Danish government says information relating to 8.8 million people was accessed. The register contains approximately 11 million records, including those of deceased people and people who have moved abroad. The government did not respond to questions about the alleged password failings.
According to documents obtained by broadcaster TV 2, the attacker gained access to the CPR system on September 10 and ran the 14 million automated searches between then and September 20.
The intrusion was detected on October 2, 12 days after the last reported searches.
Mikkel Leihardt, director of the government's higher education and science ministry, told reporters at a press conference that the attack was discovered after a department staffer picked up an invoice indicating unusually high activity from Pays.
The Danish data protection authority, Datatilsynet, was notified on October 4, and the government disclosed the attack the following day. ®