Hacker Claims Weak “123456” Password Exposed Data of 8.8 Million People in Denmark

In what appears to be a bizarre cybersecurity blunder, the password “123456” may have helped hackers access Denmark’s national population register. The breach affected information linked to approximately 8.8 million people. Now, reports are raising serious questions about how a basic password could expose such sensitive records.

Denmark’s massive data breach reportedly involved a painfully weak password

An individual claiming responsibility for the attack told Danish newspaper Politiken that a leaked password helped them gain access through an IT company. The company, Pays ApS, confirmed that attackers abused its legitimate access to Denmark’s Central Register of Persons, known as CPR.

Politiken reportedly found that at least three company accounts used “123456,” including an administrator account. However, authorities have not independently confirmed that this password was the precise entry point.

The compromised register contains highly sensitive personal information. Danish authorities confirmed that information relating to approximately 8.8 million people was accessed. This includes names, addresses, and personal identification numbers.

Attackers reportedly ran millions of automated searches

The incident reportedly began in September, with suspicious activity detected on October 2. According to documents obtained by Danish broadcaster TV 2, the attackers conducted approximately 14 million automated searches during the reported activity period.

The breach came to light after an employee noticed an invoice indicating unusually high activity. Authorities disclosed the incident on October 5 and notified Denmark’s data protection authority. The individual claiming responsibility told Politiken they had no plans to sell or leak the information. However, that statement does not establish whether the stolen data remains secure or whether other parties accessed it.

A password mistake with enormous consequences

The incident highlights how weak credentials can undermine access to sensitive systems, even when those systems belong to government infrastructure. Security experts have repeatedly warned against easily guessed passwords and reused credentials.

Organizations should enforce strong, unique passwords, enable multifactor authentication, and monitor unusual access patterns. Administrative accounts also require tighter controls because their compromise can expose far more than a single user account. For now, the investigation continues, and the precise attack method has not been conclusively established.

via: The Register