Danish Population Registry Breach Reportedly Used '123456' Password, Exposing Data of 8.8 Million

The CPR is Denmark's Central Register of Persons. It maintains identifying information including names, addresses, birth dates, citizenship and marital status. Each person is assigned a unique 10-digit CPR number widely used in healthcare, taxation, banking and other services. In a press release, the CPR said someone gained unauthorized access 'by abusing a Danish company's legal access to search for information in the CPR system.' It said companies with a legitimate interest can pull information about 'a larger, limited group of persons whom the company has identified in advance individually.'

The registry did not name the attacker or the company in its initial release and said its investigation was ongoing. It also said it had taken steps to strengthen its security. Danish media later reported the attack occurred through Funen-based Pays ApS, a detail confirmed by managing director Sophie Laursen, according to TechRadar. Pays was authorized to access the CPR system. The intrusion was spotted at the end of the month when a government employee saw an unusually high activity log from Pays for the previous month.

Local TV station TV 2 reported that the attacker ran 14 million automated searches in ten days, according to TechRadar. Pays' website was taken offline; at press time it was operating normally.

The CPR said data on roughly 8.8 million people may have been exposed, including names, addresses, CPR numbers and other details. TechRadar noted that Denmark's entire population is just over six million, according to Worldometer, while the CPR says it holds about 11 million records, including deceased people and those living abroad. TechRadar described the incident as a supply chain attack.

Danish publication Politiken claims to have spoken to the attacker via an encrypted chat service. The threat actor, who was not named, said they used login credentials belonging to a former employee whose password was '123456.' After logging in, the attacker said, they created two scripts to pull information out of CPR and into a third-party system. The attacker alleged that three separate accounts were found using the same simple password.

The attacker told Politiken they had no intention of leaking or selling the stolen data and said they were 'really shocked' by how poor the security posture was. 'Someone leaves a suitcase with 10 kilos of plutonium unattended at a train station. Then a homeless person steals it,' the hacker said. 'Yes, of course you shouldn't steal other people's suitcases. But you also shouldn't leave nuclear material at a train station.'

Politiken said the attacker gave it a file containing CPR numbers, and the publication confirmed its authenticity with independent cybersecurity researcher Emil Hørning. Hørning said the attacker's account 'appeared credible' and that the methods described were 'plausible.'

TechRadar noted that while the attacker said they did not intend to sell or leak the data, names, addresses, birth dates and CPR numbers used in healthcare, taxation or banking can be valuable in tailored phishing attacks that could lead to ransomware infections and wire fraud.