Massive Danish Data Breach Traced Back to Pays Accounts Using '123456'

At least three accounts at the company Pays used the password 123456, including an administrator account, according to reports following a massive data leak in Denmark.

In early October, the Danish government reported that cybercriminals had stolen data belonging to 8.8 million residents from the Central Person Register (CPR). The compromised information included citizens' names, addresses, and personal identification numbers. Although Denmark's population is around 6 million, the registry holds records for roughly 11 million people, including deceased individuals and former residents.

Last week, Pays ApS confirmed to the broadcaster TV 2 that attackers accessed the CPR system through its infrastructure. On Thursday, an anonymous hacker told the newspaper Politiken that they were responsible for the attack, claiming access was straightforward. The hacker stated they maintained access to the CPR registry for 21 days and 17 hours starting September 10, adding that they had no intention of selling or publishing the data.

«It is hard to imagine a worse level of protection,» said Jens Myrup Pedersen, a professor at the Department of Electrical and Computer Engineering at Aarhus University. «It was only a matter of time before trouble struck.»

Citizens have been advised to exercise caution regarding suspicious calls and emails.

Source: habr