Denmark: Password “123456” at the heart of a leak affecting 8.8 million people

Six numbers and millions of pieces of data exposed. In Denmark, an attacker allegedly used the password “123456” to hijack a company's access to the central population register, the CPR. The administration confirmed that unauthorized individuals accessed the names, addresses, identification numbers and other information of approximately 8.8 million registered individuals. The unusual activity was allegedly discovered thanks to an abnormally high consultation bill.

The key points of this article:

The authorized access of Pays ApS, a Danish company, was diverted to consult the CPR register.

According to Danish media, a leaked password, “123456,” enabled the intrusion, followed by around 14 million searches.

The case highlights the risks linked to access by providers and the late detection of mass consultations.

Diverted professional access to query the CPR register

The incident does not correspond to a public opening of the register. The attacker gained legitimate access from a company authorized to consult certain data. Pays ApS, based in Odense, confirmed to TV 2 that its access had been used fraudulently.

In particular, the company provides file updating services: address verification, identification of deceased persons and tracking changes of address. According to TV 2, cited by Malwarebytes, the password used was associated with a former employee and appeared in a previous leak.

Around 14 million searches were carried out. Access remained possible for around twenty days before it was closed on October 2, while the suspicious activity appeared to have stopped on September 20. It is an unusually high bill which would have drawn attention to these consultations.

The total of 8.8 million people also includes deaths, which is why it exceeds the country's current population. The administration specifies that the names and addresses of people benefiting from specific protection have not been exposed. This precision does not allow us to say that all their other data was spared.

The company's access was suspended, the data protection authority seized and a police investigation opened.

Personal data: A risk that also concerns crypto platforms

Beyond the password, the incident raises the question of access monitoring. Successful authentication does not guarantee that subsequent visits are legitimate. Their frequency, volume and deviation from usual activity must also be controlled.

This issue also concerns companies that collect identity documents and supporting documents as part of know-your-customer, or KYC, procedures, particularly crypto platforms. The access granted to employees and service providers constitutes points to be protected.

Multi-factor authentication, deletion of accounts that are no longer needed, limitation of permissions and alerts on unusual consultations address additional risks. None of these devices replaces the others.

Data minimization can also reduce the consequences of an intrusion. Selective disclosure and certain cryptographic proofs make it possible, in appropriate uses, to verify an attribute without transmitting a complete file. However, they do not remove all identification obligations or the need to secure systems.