The password 123456 opened access to Denmark's population register
The breach of Denmark's Central Person Register (CPR), which exposed the names, addresses and CPR numbers of about 8.8 million people, appears to have started with one of the weakest passwords there is: 123456. An anonymous hacker told the Danish newspaper Politiken on 8 October that they logged in with the leaked password of a former employee of a small company that had legal access to the register. Politiken then reported that at least three accounts at that company, Pays ApS from Odense, used 123456, including an administrator account. The authorities have not officially confirmed the password, but the minister responsible has admitted that security "has not been good enough".
What the hacker says
We reported the breach itself when the Danish government disclosed it on 5 October: the register was not hacked directly, and the attackers used the search access of a private company. Danish law lets some companies look up people they already know in the CPR, for example to check a customer's address. Pays ApS, which had two employees as of July, confirmed to TV 2 that its access "has been abused". Its director did not answer Politiken's questions.
According to the hacker, the password had appeared in an earlier leak, and the former employee's account was still active. The hacker says they wrote two programs, one to pull records from the register and one to save them elsewhere, and gave Politiken a list of CPR numbers as proof. Emil Hørning of the Danish security firm Defend Denmark told the paper the account looks credible. The hacker also says they do not plan to sell or publish the data, which cannot be checked. Their identity is unknown.
Noticed through an invoice
No security system raised the alarm. Companies pay for every CPR lookup, and the register's administration started asking questions because of an unusually large invoice for the company's queries. By the authorities' count, there were well over 14 million search attempts. According to the Danish security firm CSIS, the searches ran for about ten days in September, more than a million a day from a two-person company, and the administration spotted the irregular activity on 2 October, almost two weeks after it ended. Each single request was within the company's permissions, so none of them looked suspicious on its own. Only the volume gave it away.
Minister for Research, Education and Digitalisation Christina Egelund says new measures against unauthorised access are in place, and she has ordered a security review of the whole register. Denmark's Agency for Civil Protection now says a CPR number can no longer be relied on to identify a person.
Why it matters outside Denmark
Many countries have a national registry and give private companies some form of access to it: banks, debt collectors, delivery and marketing firms. The registry itself can be well protected and still leak through the weakest of those customers. In this case two basic things failed at once: an old account was not switched off, and it had a password that any password list tries first. If you run a service that lets partners query your data, the lesson from Denmark is to watch for accounts that suddenly pull far more data than usual, even when every login is valid.
