Weak Password Linked to Massive Breach of Danish Population Registry
Compromised partner credentials exposed personal data belonging to 8.8 million Danish citizens.
1Critical Population Registry Compromise
A major cyber incident struck Denmark's Central Register of Persons (CPR), exposing records of 8.8 million individuals out of roughly 11 million total entries. The registry stores vital personal data, including historical files of deceased citizens and expatriates. Danish authorities officially confirmed the unlawful data exposure on October 5.
2Trivial Credential Exploitation
The individual claiming responsibility stated access was obtained using the basic password '123456'. Danish newspaper Politiken reported that at least three corporate accounts, including an administrator profile, shared this weak credential. The intruder asserted they had no intention of distributing, leaking, or monetizing the compromised registry records.
3Third-Party Vendor Involvement
The breach originated through legitimate API access assigned to Funen-based firm Pays ApS. Managing director Sophie Laursen confirmed on October 9 that their authorized gateway was exploited. The company historically utilized CPR data to validate customer records. Following the incident disclosure, Pays took down its official business website entirely.
4Mass Automated Data Harvesting
Internal documents revealed the attacker secured initial system access on September 10. Over the following ten days, approximately 14 million automated search queries were executed against the CPR database. The exfiltration activity ceased on September 20, remaining unnoticed by automated monitoring tools while querying millions of public citizen profiles.
5Belated Anomaly Detection
The intrusion went undetected until October 2, twelve days after active querying ended. Discovery occurred manually when an education ministry staff member reviewed a vendor invoice showing extraordinarily high transaction volumes from Pays. This administrative billing check prompted immediate technical scrutiny, revealing widespread illegitimate activity across external API access points.
6Formal Regulatory Notification
Following internal verification, authorities alerted the Danish data protection agency, Datatilsynet, on October 4. The government published a public notice the next day detailing the breach scope. Higher education ministry director Mikkel Leihardt addressed media inquiries, though officials declined to comment on specific authentication vulnerabilities at vendor endpoints.
7Vendor Security Governance Risks
This incident illustrates severe systemic risks tied to third-party integration architectures. When external suppliers maintain administrative rights without enforcing robust multi-factor authentication or complexity rules, central databases face severe exposure. Even verified partner connections can bypass standard perimeter protections if credential hygiene and operational audits remain inadequately enforced.
8Operational Visibility and Rate Limiting
The delay between automated exfiltration and billing-based detection emphasizes critical architectural deficiencies. High-volume database integrations require automated anomaly detection, real-time rate limiting, and dynamic query threshold alerts. Relying on monthly financial invoices rather than real-time telemetry leaves critical infrastructure vulnerable to massive data harvesting attacks by external actors.