•According to a report by PC Gamer, the hack of Denmark’s Central Register of Persons (CPR) that exposed 8.8 million people’s personal details appears to have been enabled by a private firm whose account used the password ‘123456’.
The CPR administration said earlier this month that it had suffered a breach, exposing names, addresses and ID numbers of 8.8 million people, both living and deceased. It was confirmed at the time that legitimate access held by a private Danish firm had been exploited by the attacker.
A person claiming responsibility for the attack has come forward this week, saying they gained access to the CPR through an account using the password ‘123456’. According to PC Gamer, this was one of three accounts held by the private firm with that same password. One of these was an administrator account.
The Danish firm at the heart of the attack has been identified as Pays ApS. The company was granted access to the CPR in order to provide various services, such as validating business customers’ records.
The self-identified attacker gained access to the Pays ApS account on September 10 and used it for searches. The attack was only discovered on October 2, when an employee at the Ministry of Research, Education and Digitalisation noticed an unusually high invoice indicating that many more searches than normal were being made by Pays ApS.
The attacker says they have no intention of leaking or selling the data they lifted.
Hackers are well aware of common passwords. The bottom line is a reminder that those who should know better do not always maintain strong password management, and it may be worth updating passwords to something unique or investigating password tools.
1 comment