Denmark Data Breach Exposes 8.8 Million Records Using Password 123456
A massive security breach compromised Denmark’s national population database, affecting information of approximately 8.8 million individuals. Alarmingly, the hacker accessed the system by exploiting the extremely weak password “123456,” widely considered one of the most insufficient passwords globally.
Details of the Denmark Data Breach
The breach targeted Denmark’s Central Person Register (CPR), a comprehensive database containing sensitive information such as full names, home addresses, and CPR identification numbers. These identification numbers serve critical functions across healthcare, banking, and taxation sectors in Denmark.
The attacker gained entry through Pays ApS, a private company authorized to access the CPR for specific inquiries. Investigations revealed that at least three of Pays ApS’s company accounts were protected by the feeble password “123456.” Taking advantage of this, the hacker executed roughly 14 million automated queries over a 10-day span in September, harvesting data far exceeding the country’s living population of about six million because CPR also stores records of deceased and emigrated individuals.
Response and Implications for Pakistan
The breach was detected on October 2 when unusual activity surfaced in the form of an invoice showing excessive database search volumes. Subsequent to the discovery, Denmark’s digital affairs minister condemned the incident as “an extremely serious incident.” Access for Pays ApS was immediately revoked, and the national Data Protection Agency was notified on October 4. Public confirmation of the breach followed the next day.
Although the hacker approached Danish media to clarify their motives—claiming no intention to leak or sell the stolen data and expressing shock at the poor security standards—the police have yet to identify or apprehend any suspects. The involved company also temporarily shut down its website after the incident became public.
This event serves as a cautionary tale for Pakistan, where cybersecurity challenges are rapidly evolving amid increased digitalization of national databases and services. With entities like NADRA managing vast personal data repositories, the Danish breach underscores the critical importance of robust password policies and strict access controls to prevent unauthorized access and protect citizens’ sensitive information from exploitation.
