An investigation into a major Danish data breach reveals how a weak administrator password and accounts utilizing '123456' allowed the extraction of nearly 8.8 million national ID records via abused legitimate system permissions rather than direct core infrastructure compromise.
How was access obtained?
At least three accounts at Pays, an IT company on the Danish island of Funen, used the password "123456", including an administrator account.
The company had legal permission to search for information in Denmark's national citizen register. An attacker allegedly used this authorized access to harvest personal records, rather than breaching the registry's central systems.
According to an investigation by the newspaper Politiken, the hacker shared the stolen data with the newspaper and claimed that the password “123456” helped unlock access. Another report said that the access began through a leaked password from a former employee of a small Danish company.
The files collected
The records reported concern 8.749.975 records, which include approximately 5,5 million living people and 3,3 million deceased people.
The perpetrator allegedly created two programs to extract information from the registry and store it off-system. This activity reportedly began on September 10 and lasted 21 days and 17 hours.
The company's response
Pays confirmed to a television station that its legitimate access to the system had been abused. The director and owner, Sophie Laursen, admitted the incident via email.
Private companies and organizations can access the registry when they have a legitimate need, such as checking customer or member addresses. The perpetrator told the newspaper that there were no plans to sell or publish the information.
So far, available evidence does not indicate that the exposed information has already been used for fraud.
Top comments (0)