The breach of Denmark's Central Register of Persons (CPR), affecting 8.8 million people, was reportedly made possible by an IT company's account protected by the password "123456." According to The Register, a person claiming responsibility told Danish outlet Politiken they gained access through that account. At least three accounts, including an administrator account, used the same weak password.
The company in question is Funen-based Pays ApS, which had authorized access to the CPR system for validating business customers' records. Managing director Sophie Laursen confirmed on October 9 that Pays' access was exploited. The company's website has been taken offline, and it has not responded to further questions. The Danish government has not commented on the alleged password failings.
The attacker ran 14 million automated searches between September 10 and September 20, according to documents obtained by broadcaster TV 2. The intrusion was only detected on October 2, after a government staffer noticed an invoice showing unusually high activity from Pays. Datatilsynet, the Danish data protection authority, was notified on October 4, and the government disclosed the attack the following day. The claimant said they had no intention of selling or leaking the data.