[CLSTR]
< Back to all clusters
[TECHNOLOGY] · Denmark · 18 sources

started · updated

Part of situation: Denmark CPR data breach and new security mandates (6 clusters)

Denmark CPR registry breach exposes data of 8.8 million people

data breach cybersecurity Central Person Register weak password supply chain attack

A major data breach in Denmark has exposed the personal information of approximately 8.8 million people, including both living citizens and deceased individuals. The breach targeted the Danish Central Person Register (CPR), a national database containing roughly 11 million records.

The unauthorized access was achieved through a supply chain attack on Pays ApS, a small IT services firm based in Odense that holds legitimate credentials to query the CPR. Reports indicate that the intruder gained access by exploiting weak credentials, specifically the common password ‘123456’, which was reportedly used across at least three company accounts, including one with administrator privileges.

The breach occurred between September 10 and September 20, during which the attacker performed approximately 14 million automated queries. The incident went undetected for several weeks and was only discovered on October 2 after a ministry staffer noticed an unusually large invoice related to the volume of searches performed by Pays ApS.

Authorities have since suspended the company’s access to the registry and launched investigations. The attacker, who claims to have used an AI model to develop the extraction program, stated they have no intention of selling or publishing the stolen data.

Entities

Aarhus University · CPR Administration · Central Person Register · Christina Egelund · Danish Data Protection Authority · Denmark · Pays ApS · Politiken · Sophie Laursen

Claims

What the coverage asserts, and how many sources carry each claim.

Sources

Dados de 9 milhões de dinamarqueses vazam após senha 123456 [www.brasilemfolhas.com.br]
Danimarca, dati di 8,8 milioni esposti per “123456” [www.chiccheinformatiche.com]
IT-firma brugte kodeordet 123456: Sådan slap tyven ind til 8,8 millioner CPR-numre [trend.dk]
Parola „123456” a costat scump statul danez: hackerii au furat datele personale a 8. 8 milioane de cetățeni [arenait.ro]
Denmark’s Hackers Didn’t Need Skill, They Needed an AI and a Bad Password [datafloq.com]
Le mot de passe « 123456 » ouvre les portes du système CPR danois, exposant une grande partie de la population - Sécurité [www.developpez.net]
Senha “123456” teria permitido a hackers acessar dados de 8,8 milhões de pessoas [www.hardware.com.br]
Пробив в национален регистър на Дания засегна данни на 8. 8 милиона души [novini247.com]
8,7 millioner CPR-numre kompromitteret: Nu kommer opsigtsvækkende afsløring om hackeren [nyheder24.dk]
The Register: ‘123456’ password linked to Denmark data breach affecting 8. 8M people [rbfirehose.com]
Lời khuyên cho tất cả người đang đặt mật khẩu "123456" [cafef.vn]
Lời khuyên cho tất cả người đang đặt mật khẩu "123456" [kenh14.vn]
'123456' password was the only thing standing between hacker and data of 8. 8 million people [www.techradar.com]
La password più stupida del mondo è responsabile per il furto dei dati di 8,8 milioni di persone [www.smartworld.it]
Hacker used '123456' password to breach registry [www.technobaboy.com]
Falha amadora: Senha '123456' expõe dados de todos os habitantes de um país europeu [canaltech.com.br]
Le mot de passe 123456 aurait ouvert l’accès aux données de 8,8 millions de personnes [www.clubic.com]
Major IT firm hacked because those who should know better reportedly used '123456' as a password [www.pcgamer.com]