‘123456’ password was all a hacker reportedly needed to expose over 8 million people’s personal data
Denmark’s Central Register of Persons (CPR) suffered a significant data breach in September that exposed personal information for approximately 8.8 million people, including both living and deceased individuals. The breach was discovered and announced earlier in October.
According to reports, the attacker exploited legitimate access credentials belonging to a private Danish firm to gain entry to the system. Notably, the password used to compromise the account was ‘123456’—a simple, commonly-used numerical sequence that exemplifies extremely poor security practices.
The exposed data included sensitive personal identifiers such as full names, residential addresses, and national ID numbers. The CPR is a fundamental government database containing citizen registration information, making this breach particularly significant given the scope and sensitivity of the information compromised.
The incident underscores critical cybersecurity vulnerabilities in systems handling sensitive personal data. Despite 123456 being one of the most commonly used and recommended-against passwords in the world, it apparently remained acceptable for accessing a system managing information on millions of people. This breach highlights the importance of enforcing strong password policies, multi-factor authentication, and regular security audits for systems containing personal data at scale.
The attack demonstrates how organizational security is often only as strong as its weakest credential, and how attackers can achieve significant breaches by exploiting basic weaknesses in access controls rather than sophisticated technical exploits.