How “123456” became the key to almost 9 million personal records
Attackers used the password 123456 to query Denmark’s CPR register, exposing records on about 8.8 million people.
Attackers abused Pays ApS’s authorized access to Denmark’s civil population register using a former employee’s leaked password, 123456, which had appeared in an earlier data leak. Over 21 days they ran about 14 million searches, obtaining names, addresses, and CPR numbers for roughly 5.5 million living and 3.3 million deceased people. Suspicious querying stopped on September 20 and access was shut down on October 2 after an unusually large bill drew attention.
- A leaked former Pays employee password, 123456, unlocked authorized CPR search access.
- Attackers made about 14 million searches during 21 days of access.
- Exposed data covered about 5.5 million living and 3.3 million deceased people.
- The incident surfaced after an unusually large bill, not proactive monitoring.
- Suspicious activity stopped September 20; access was cut off October 2.
Full article526 words · extracted from malwarebytes.com · click to collapse
An attacker reportedly used a leaked password to abuse a company’s legitimate access to Denmark’s population register (CPR). The weak password is remarkable, but the failure to spot millions of unusual searches made the breach worse.
The CPR administration states it identified a serious security incident. By abusing a Danish company’s authorized access to the CPR system, unauthorized people gained access to the names, addresses, CPR numbers, and other information belonging to around 8.8 million people registered in the system. CPR numbers are Denmark’s personal identification numbers.
How could a password so weak that it should have been rejected by the system open the door to so much personal information?
The attacker reportedly gained access through Pays ApS, an IT company based in Odense. According to TV 2, Pays has confirmed that its authorized access to search the CPR system was abused. Pays offers services including data updates and “CPR cleansing,” allowing customers to check records against the register to update addresses, identify people who have died, and obtain information about changes of address.
The attacker reportedly used a leaked password associated with a former Pays employee. TV 2 says an email containing the password 123456 had appeared in a larger data leak, and that this account of the initial access matches its own research.
The attackers had access for 21 days before it was shut down on October 2, although the suspicious activity appears to have stopped on September 20. An unusually large bill for around 14 million searches drew attention to the breach.
Politiken reports that the data stolen in those searches belonged to approximately 5.5 million living and 3.3 million deceased people.
A weak, leaked password opened an authorized route into a sensitive register. That access allowed millions of searches, and the activity was discovered only after an unusually large bill drew attention to it.
How to stay safe
If your organization handles sensitive data:
- Don’t reuse passwords or use personal passwords for work accounts. Use a password manager to create and remember strong, unique passwords for you.
- For systems that give access to sensitive data, enforce authentication that would reject weak passwords and make multi-factor authentication mandatory.
- Monitor for unusual activity. That many searches from one account should have been noticed earlier.
If your data may have been exposed in this breach:
- Keep an eye on official updates about the incident.
- Be alert to phishing and other scams. Scammers could use personal details to make their messages more convincing.
- Read our blog Involved in a data breach? Here’s what you need to know.
Pro tip: Use Malwarebytes Scam Guard if you’re unsure if a message is legitimate. It can help you determine whether it’s a scam and what to do next.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.
About the author
Was a Microsoft MVP in consumer security for 12 years running. Can speak four languages. Smells of rich mahogany and leather-bound books.