Hacker Accesses Denmark's National ID Database with Password '123456', Leaking Information of 8.8 Million People
A hacker accessed Denmark's Central Personal Register (CPR) using the password '123456', obtaining the names, addresses, and ID numbers of approximately 8.8 million people.
The access route was through the small IT company Pays ApS, which had legitimate query permissions. The hacker claimed to have logged in using a password leaked by a former employee, and at least three accounts (including an administrator) used the same password.
The CPR management agency confirmed a data breach occurred in September, involving about 8.8 million records of both living and deceased individuals. Sophie Laursen, Managing Director of Pays ApS, confirmed on October 9 that their access was abused.
The attacker executed approximately 14 million automated queries between September 10 and 20, with the activity lasting about 21 days, ultimately being discovered and the account closed due to an unusual invoice amount.
The hacker told Danish media Politiken that they had no intention of selling or publicly disclosing the data, describing the security situation as "shocking."
Market mechanism: The buyer is a potential user seeking identity data, and the seller is a third-party vendor with legitimate access. The incident is driven by weak passwords and third-party access, with funds flowing towards identity verification and potential abuse scenarios. The beneficiaries are the attackers who obtained the data, while the parties under pressure are the data subjects, government agencies, and vendors that failed to monitor unusual queries.
Source: Public information
ABAB AI Insight
Denmark's CPR, as a national population registration system, has long provided query services through authorized third parties. Historical similar incidents show that expanding third-party access increases the attack surface. This breach through weak password accounts at Pays ApS exposes deficiencies in vendor security practices and government monitoring capabilities.
In terms of capital flow, data was extracted in bulk through legitimate query interfaces, with funds and resources directed towards identity verification, credit, or potential fraud scenarios. The motivation lies in leveraging existing authorizations to lower the intrusion threshold, rather than directly breaching government systems.
In comparison to other countries' identity databases or public record systems being abused due to weak credentials of vendors, we are currently in a phase where digital public services rely on third-party interfaces. Similar supply chain security incidents show that a single weak link can lead to large-scale exposure.
Structurally, this belongs to the intersection of regulatory changes and technological substitution: third-party authorized queries have become a data acquisition path, with the mechanism being that permissions are concentrated among a few vendors while monitoring and password policies lag behind, allowing a single weak credential to trigger large-scale automated extraction, highlighting the reliance on third-party security and monitoring of abnormal behavior.
ABAB News · Cognitive Laws
The weakest credential determines the exposure range of the entire system.
When legitimate permissions are abused, monitoring is more critical than the entry point.
Third-party access expands the attack surface, and password strength determines the boundary.