Hacker used ‘123456’ to access data of 8.8 million in Danish Register, Politiken says
A cyberattacker gained access to the Danish Central Person Register in September, compromising the personal data of 8.8 million people through an administrative account secured with the password ‘123456’. According to the Danish newspaper Politiken, the unauthorized entry allowed the digital intruder to download sensitive records over a three-week period before the breach was discovered on October 2.
The breach exposed names, addresses, and personal identification numbers comparable to social security numbers. While Denmark’s resident population sits at approximately six million, the registry holds 8.8 million records because it includes individuals who moved abroad and deceased persons.
Hacker Used Third Party Accounts to Enter System
The attacker did not breach the civil registry’s core systems directly. Instead, the intrusion leveraged existing legal access granted to an external private company. The hacker utilized three separate accounts within that third-party access framework, including an administrative login secured by the basic numeric sequence. Jens Myrup Pedersen, a computer scientist at Aarhus University, described the security setup to the Danish outlet Politiken as ’hopeloos’, characterizing it as an open door.
The compromised credentials allowed the individual to maintain unimpeded access to the database for 21 days. During this window, large-scale data harvesting took place without immediate detection by system administrators. The Central Person Register (CPR) only flagged unusual system activity on a Friday evening, prompting an immediate revocation of the private firm’s access rights.
Minister Labels Security Failure as Serious Event
Minister Egelund of Digital Affairs addressed the incident, labeling the security failure as a very serious event and urging citizens to remain alert against potential downstream risks. The breach has been formally reported to the Danish Data Protection Agency, while national police forces have opened a formal investigation into the intrusion.
The database extract specifically includes the private information of roughly 5.5 million living residents and 3.3 million deceased individuals. Despite the scale of the data exfiltration, the hacker told Politiken that no public dissemination or commercial sale of the acquired personal records was planned.
Unresolved Questions Surrounding the Incident
Authorities have not yet identified the perpetrator behind the digital break-in, and the precise vector used by the external company to store or handle the administrative credentials remains under review.
