Massive Denmark data breach linked to '123456' password

Names, addresses and personal identification numbers belonging to 8.8 million people in Denmark was accessed by an unauthorised party through a third party IT company's account protected by the password '123456'.

Danish news outlet Politiken reports at least three company accounts, including an administrator, used the same password.

The person claiming responsibility said that they did not intend to steal the data they accessed in the country's Central Register of Persons (CPR).

We spot scams like this every week in The Scam Hound newsletter — one email, every Tuesday, free. → subscribe

The breach was spotted on 2 October, with the CPR confirming it three days later - however, broadcaster TV2 says the hacker had access from 10 September for 21 days, meaning it was another 12 days until it was discovered by officials.

The CPR system contains approximately 11 millions registered Danish citizens, including those who have moved abroad and the deceased.

“This is a deeply serious incident,” digitalisation minister Christina Egelund said. "Together with all relevant authorities, we are in the process of mapping the full extent of the incident."

We at The Scam Hound have recently covered how you can make your passwords as secure as possible, with the National Cyber Security Centre also recommending two-step verification as a backup.

Found us through a search engine? Click here to join our newsletter, or contact us and send your email and we will add you into our community. We do not share your information.  You will get free, weekly updates on the latest scams to protect you and your family.