Denmark Population Registry Data Leak via Weak Password

An anonymous hacker gained access to Denmark's central population registry by exploiting weak security measures of a contractor. Instead of directly breaching the database, the attacker used a leaked password belonging to a former employee of an IT company in Odense.

At least three accounts of the company were protected by the simple password "123456". In September, over 14 million requests were sent from one account to the government registry.

The result was the collection of personal data for 8.8 million people. The leak included names, addresses, and CPR numbers for 5.5 million living citizens and 3.3 million deceased individuals.

CPR is a ten-digit number starting with the date of birth, used in healthcare, banking, and when accessing public services in Denmark.

The information was saved by the attacker, who promised not to sell or publish it. The incident was only detected on October 2 due to an abnormally high bill for requests.

The Minister for Digitalization described the incident as extremely serious. The company's access has been revoked, police are investigating, and no suspects have been identified yet. Authorities warn of potential phishing attacks.