Those Who Used This Password Got Burned: 9 Million People's Data Was Leaked

The Danish population registration system CPR was subjected to a cyber attack in which the data of 8.8 million people was leaked due to a simple password such as 123456.

The Danish population registration system (CPR) came to the fore with a recent cyber attack. It was revealed that sensitive data of approximately 8.8 million people was leaked through a third-party company.

It was determined that the attackers used a very simple method to log into the system. The incident once again revealed how careful institutions should be regarding third-party access.

Weak password and data leak

CPR, Denmark's national population registration system, contains critical information of citizens such as name, address, date of birth, citizenship status and marital status. 10-digit CPR number assigned to each individual; It is used in many areas such as health, tax and banking.

It was reported that the attacker who infiltrated the system abused the legal access rights of a third-party company called Pays ApS. It was claimed that the attacker used the login information of a former employee and the password was 123456.

This situation shows how vulnerable the security of the system remains. The attacker stated that the same simple password was used on three different accounts.

Pays ApS was one of the companies that had access to the CPR system, and infiltration of the system through this authority revealed the danger of supply chain attacks. The company's management confirmed that the attack occurred through its systems.

Details of the attack and vulnerability

According to local media outlet TV 2, the attacker made 14 million robocalls in ten days. The violation was detected at the end of the month when a government employee noticed unusual activity in Pays ApS's logs.

Pays ApS's website was temporarily taken offline following the attack. The attacker stated that he had no intention of leaking or selling data and expressed surprise at the weak security measures of the system.

The attacker explained the situation with an analogy and said, "Someone leaves a suitcase full of 10 kilos of plutonium unattended at the train station and a homeless person steals it." Independent cybersecurity researcher Emil Hørning confirmed that the attacker's methods were credible.

The attacker supported his claims by presenting a dossier containing CPR numbers to the Politiken newspaper. This evidence revealed the seriousness of the extent of the violation.

Investigation process continues

In the statement made by CPR, it was stated that the investigation continues and the security measures of the system have been increased. The breached data included names and addresses, as well as CPR numbers.

Experts warn that such data can be used in spear phishing attacks. The attack is a reminder that government agencies should reconsider their data sharing protocols with third-party companies.

Security experts emphasize that not closing accounts or updating passwords, especially those of former employees, poses great risks. The capture of 8.8 million people's data with such a simple method once again proves the importance of digital security standards.

Do you think government agencies have adequate measures to control the access of third-party companies?