A massive data breach involving Denmark’s central CPR register exposed personal information linked to approximately 8.8 million records. Investigations revealed that the Funen-based IT company Pays used critically weak password security, with an administrator account and others protected only by “123456”. Experts sharply criticized the security practices as a wide-open door, noting that a breach was inevitable given the lack of safeguards. The unauthorized access lasted for over 21 days after an attacker utilized a leaked credential belonging to a former employee of a small firm. While the company confirmed its legal search access was abused, the hacker claimed they had no intention of selling or publishing the retrieved personal data.

Full report : Admin password “123456” used in Denmark CPR breach which exposed 8.8 million IDs.