A hacker accessed the Danish national registry and retrieved 8.8 million records, according to the Danish government. Copenhagen confirmed the breach and said an official described how it was found: an invoice showed an unusually high level of activity from a company, and the discovery came 12 days after the intrusion occurred. The government has not named the company the hacker exploited.
Pays ApS managing director Sophie Laursen confirmed that the hacker used the company's access to the database to exfiltrate the data. The hacker has claimed that they do not intend to sell or leak the information. The password said to have opened the door was "123456."
The case illustrates that a system's defenses are only as strong as their weakest point. The Danish database was compromised through a poorly chosen password belonging to a third-party user. The registry, known as CPR, holds information on virtually every Danish citizen, which would normally suggest a need for stronger passwords or two-factor authentication. That the password was "123456" points to a gap between the sensitivity of the data and the controls protecting it.
Similar failures in government database protection have surfaced before. Indonesia found it had no backups when a ransomware attack in 2024 affected more than 230 public agencies. South Korea lost 858 terabytes of data after a catastrophic fire at a government data center last year. Both cases, like the Danish breach, involved systems holding large volumes of public records.
Danish authorities are expected to revise their password policies in the near term, particularly as AI makes it easier and faster for attackers to reach their targets. Recent incidents reportedly carried out with the help of AI agents include attacks on South Korean banks and against the Taiwanese government. Hackers also breached OpenAI using Claude tools.
Those AI-assisted campaigns show how effective the technology has become in the wrong hands. A password like "123456," however, requires no such sophistication to exploit.
More cybersecurity news from TechManNews.
