6-digit password exposed 8 million people’s data
Imagine a digital vault holding the most intimate details of a nation: names, addresses, and identification numbers. In Denmark, that vault—the Central Register of Persons (CPR)—recently suffered a major security failure, exposing the private information of 8.8 million people, both living and deceased.
The breach wasn’t the result of a sophisticated external hack, but rather the exploitation of legitimate access. The attack traced back to a private Danish firm, Pays ApS, which was authorized to access the CPR for providing various validation services to business customers.
The critical vulnerability lay in the security protocols of the firm itself. The attacker gained entry by utilizing a shockingly common password, 123456. This seemingly simple sequence provided the key to a chain of access, as the firm held multiple accounts using this same credential, including an administrator account.
Once inside, the attacker acted with calculated speed. On September 10, the breach began, allowing the hacker to run 14 million automated searches of the CPR between that date and September 20. This massive data sweep was the core of the exposure.
The discovery of this serious breach was not immediate. It was only flagged on October 2 when an employee at the Ministry of Research, Education and Digitalisation noticed an unusually high invoice, indicating far more searches than normal were being conducted by Pays ApS.
This incident serves as a stark reminder that even seemingly secure systems can be compromised by poor internal security practices. Hackers are acutely aware that the most common passwords, like 123456, are bafflingly popular, making them an easy target for automated attacks.
While the self-identified attacker claimed no intention of selling the stolen data, the incident underscores a crucial lesson: password management is far more than just a matter of convenience. It is a fundamental line of defense.
Security experts emphasize that relying on easily guessable credentials leaves systems wide open. It is time to stop treating passwords as simple, memorable sequences and start treating them as the critical security assets they are. Updating passwords to unique, complex phrases or investigating advanced security tools is no longer optional—it is essential for protecting our digital lives.
Buy on Amazon
Credit
