The hacker entered the password "123456" and downloaded the data of millions of citizens

The Danish government announced on Monday that unauthorized persons gained access to 8.8 million CPR numbers (equivalents of Polish PESEL numbers), names and addresses of both living and deceased people, as well as Danes living abroad. The case was described as "serious" and the police are investigating.

How did the data leak occur?

The "Politiken" daily established contact via an encrypted messenger with an anonymous person who, as evidence, first provided personal data of one of the newspaper's journalists, and then provided files regarding 8.8 million CPR numbers.

The hacker's account, considered very probable by the quoted experts, shows that he first used the password of an employee of one of the Danish private companies that had legal access to the CPR register, which was not secured with additional authentication.

The second step was to create software capable of automatically sending queries to the database and saving the results.

Was the data available for a longer period of time?

Danish public broadcaster DR reported that access to the registry had already been leaked last year and was available online, meaning that Danes' data was exposed to exploitation for a longer period of time.

There is an ongoing debate in the media whether criminals could have used them to extort more information or money by impersonating state institutions or foreign intelligence. After the case was revealed, many offices tightened their requirements when handling civic matters.

The CPR register includes data on approximately 11 million citizens, living and deceased, as well as residents and Danes who have moved abroad. Denmark is inhabited by over 6 million people.