The publication reported that at least three accounts belonging to the firm, including an administrator account, relied on the exact same numerical string.
A hacker has reportedly claimed responsibility for breaching Denmark’s national identity database saying that the massive intrusion was carried out using the ‘most insecure password’ for the last six years: “123456. ” The breach compromised Denmark’s Central Register of Persons (CPR), exposing records connected to approximately 8.8 million people. The individual told the outlet (via The Register) that they have no intention of leaking or selling the accessed citizen information. Speaking to Danish newspaper Politiken, the alleged hacker claimed they gained entry via an external IT contractor’s legitimate corporate account secured by this sequence.
How 10 days of automated scraping went undetected
On October 5, Denmark’s CPR administration publicly confirmed the security failure, disclosing that an authorised third-party contractor’s legitimate system credentials had been abused to pull records. Sophie Laursen, managing director of Funen-based firm Pays ApS, confirmed on October 9 that her company’s access pathway had been exploited While authorities did not initially name the vendor involved. Internal documents reviewed by Danish broadcaster TV 2 reveal the intruder had free rein inside the national system for over a week. The attacker first penetrated the CPR database on September 10 and between September 10 and September 20, the intruder executed roughly 14 million automated database queries. The intrusion was not uncovered until October 2, nearly two weeks after the automated scraping activity ceased. Danish data privacy watchdog Datatilsynet was formally alerted on October 4, followed by a public government announcement on October 5.
“123456” remains the most common – and dangerous – credential on the internet, according to password management firm NordPass. The firm noted that the simple sequence has retained the top spot as the world’s most widely used password in six out of the past seven years (since the starting of the publication of the list) briefly ceding ground only once to “password”. It also says that “12345” and “123456” emerged as the top password choice in every age group: Generation Z, Millennials, Generation X, Baby boomers and Silent generation.
Pays held authorised access to the national CPR infrastructure to deliver commercial verification services, such as validating business customer records. Following the disclosures, Pays took its corporate website offline and the homepage reflects the message: “Page is under construction. For contact use the information below” with its office address in Denmark. The unusual activity was caught almost by accident. Mikkel Leihardt, director at the Danish Ministry of Higher Education and Science, explained during a press conference that the breach came to light only after a department staffer flagged a billing invoice showing an abnormally high volume of query activity charged to Pays. You use AI every day. Now get your AI Quotient. Take the AIQ test.
Danish officials confirmed that data relating to 8.8 million people was accessed during the incident. The national registry holds roughly 11 million files overall, a total that includes records for deceased citizens and individuals who have relocated overseas.