Hackers claim to have broken into Denmark’s national registry using the weak 123456 password, exposing 8.8 million personal records. The attack targeted Pays ApS, an IT company with access to the CPR database.
Investigators say the hacker ran 14 million automated searches between September 10 and 20. The breach was only discovered on October 2 after an unusual invoice flagged the activity. Pays ApS later confirmed its accounts were abused, including one linked to a former employee.
The CPR database holds sensitive details on nearly every citizen. Reports show 5.5 million living and 3.3 million deceased individuals were affected. The password had already been leaked in a past data dump, making the system even more vulnerable.
The hacker claims they will not leak or sell the data, but the incident shows the effects of poor password management. Experts point out that using simple passwords like 123456 is unacceptable for systems holding national records. They stress the need for stronger password rules, multi-factor authentication, and better monitoring of unusual activity.
Also Read: Discord bot breach exposes 1M users
This breach shows how one weak password can put millions at risk. For everyday users, it’s a reminder to avoid common passwords and turn on extra security features to protect your accounts.
