You won't believe the password: How a hacker breached Denmark's national registry

A hacker breached Denmark's national population registry using the simple password '123456' through an external IT company. Data of 8.8 million people, including ID numbers, was exposed. Authorities discovered the breach two weeks late.

A hacker breached Denmark's national population registry, a database containing sensitive information on the country's citizens. The breach was carried out through an external IT company named Pays ApS, which had legal authorization to retrieve data from the registry. The hacker logged in using a former employee's account, which was protected by the password '123456'. At least three accounts in the company used the same simple password without two-factor authentication. The hacker ran 14 million queries over ten days and exported the data to an external server. The exposed information includes names, addresses, dates of birth, and CPR numbers (ID numbers) of 8.8 million people – more than Denmark's entire population. Authorities did not detect the breach in real time and only discovered it about two weeks after it ended, when a government employee noticed an unusual monthly invoice. The hacker expressed shock at the poor security level, comparing the situation to 'a plutonium suitcase left unattended at a train station'. Security experts warn of immediate danger to citizens due to the exposure of ID numbers.