A hacker claiming responsibility for the breach of Denmark’s Central Register of Persons (CPR) says it was protected by “123456,” a password that has topped most-common-password lists for years. Speaking to Danish newspaper Politiken, the person said at least three accounts at Pays ApS, a two-employee IT company in Odense with authorized access to the register, used that exact password, and one of them was an administrator account. Danish authorities confirmed the breach on October 5, saying the names, addresses, and CPR numbers of around 8.8 million people were exposed, including deceased people and those who have moved abroad. Pays managing director Sophie Laursen confirmed on October 9 that the company’s access had been abused, and its website has since gone offline.Documents obtained by Danish broadcaster TV 2 show the attacker got in on September 10 and ran roughly 14 million automated searches through September 20. Apparently, nobody caught it until October 2, when a ministry staffer spotted an invoice showing unusually high activity from Pays. Some reports also say the initial entry came through a leaked password tied to a former employee, though those details are still murky. The hacker claims they have no plans to sell or leak the data. That may not count for much, since Denmark’s Agency for Public Security (Samsik) now says a CPR number can no longer be trusted on its own to verify someone’s identity. Readers in Denmark are advised to watch out for phishing messages that use their personal details, and if you’re still using the “123456” password anywhere, it’s probably time to change it.
Click Here For The Original Source.
——————————————————–
