Denmark data breach exposes 8.8 million identities via weak password

A major cybersecurity breach in Denmark has exposed the personal data of approximately 8.8 million people. The unauthorized access targeted the Danish Civil Registration System (CPR), which holds essential identity information including names, addresses, and personal identification numbers.

The breach occurred between September 10 and September 20, during which the attacker performed roughly 14 million automated searches. The intrusion was not the result of sophisticated hacking techniques but rather the exploitation of a weak password, ‘123456’, used by an account at the IT company Pays ApS. The company had authorized access to validate client data, which the attacker misused.

The breach was discovered on October 2 after a ministry employee noticed abnormally high activity on an invoice from Pays ApS. While the data was not intended for sale or leak, the exposure of CPR numbers poses significant risks for identity theft and fraud. Sophie Laursen, director of Pays ApS, confirmed the company's account was the one compromised.