Weak password exposed Denmark’s personal register data for 8.8 million people
A breach of Denmark’s Central Register of Persons exposed information relating to 8.8 million people after the register’s authorised access through an IT company was abused. A person claiming responsibility told Danish media they used an account protected by the password “123456” and said they did not intend to sell or leak the data.
At least three company accounts, including an administrator account, reportedly shared that password. Documents obtained by TV 2 indicate the attacker made 14 million automated searches from 10 to 20 September; the intrusion was detected on 2 October after an unusually high activity invoice drew attention. Authorities were notified on 4 October, and the government announced the breach the next day; the register holds about 11 million records, including people who have died or moved abroad.
- Denmark’s people register breach affected 8.8 million people.
- An alleged route in was an account using “123456”.
- The attacker reportedly ran 14 million searches in ten days.
New here? Start with this
Denmark's Central Register of Persons is a government database containing personal information about residents. It is used by public agencies and authorised companies for administrative purposes such as verification. The register holds records for approximately 11 million people, including those who have moved abroad or died.
Someone used an account belonging to an IT company to gain unauthorised access to the register. The account was protected by an extremely weak password, allowing the person to search the database without being detected. The breach exposed personal information relating to 8.8 million people before being discovered in early October.
The incident reveals vulnerabilities in how government agencies protect their most sensitive systems. When organisations with access to large databases employ poor security practices, millions of people's personal information becomes at risk of misuse for fraud or identity theft. The breach raises questions about oversight of companies granted access to state systems and the strength of security regulation.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
This was a catastrophic security failure – protecting sensitive personal data for 8.8 million Danish citizens with a password of "123456" on administrator accounts is inexcusable and reflects institutional negligence. Those responsible must face serious consequences, and this breach demonstrates a systemic failure in how government handles digital security that demands both accountability and comprehensive reform to prevent future violations of public trust.
The case against
Whilst the password security was clearly inadequate and must be urgently remedied, the fortunate outcome deserves consideration alongside the failure. The attacker claims no malicious intent, the breach was detected within weeks before widespread harm, and there is no evidence of data being sold or leaked. Rather than emphasising punishment, authorities should focus on legitimate security improvements and understanding what allowed such lapses, ensuring the proper access controls, password requirements, and monitoring systems are implemented to prevent recurrence.
Read the full article at the source →
Originally published by The Register as “‘123456’ password linked to Denmark data breach affecting 8.8M people”.