The password "123456" has let an attacker into Denmark's national population register resulting in names, addresses and ID numbers for about 8.8 million people being exposed.
The claimant told Danish newspaper Politiken they used an account at IT company Pays ApS, which had legitimate access to the Central Person Register (CPR). Politiken reported that at least three Pays accounts, including an administrator account, used the same password.
The intrusion was spotted only when an unusually large invoice drew attention. The claimant said they had no intention of selling or leaking the data.
Denmark's CPR administration disclosed the breach on 5 October. The Ministry of Research, Education and Digitalisation said an unauthorised party had abused a Danish company's lawful access to search the system. It did not name the company.
The register holds about 11 million records, including people who have died or moved abroad. That is why the affected total exceeds Denmark's population of around 6 million. People registered with name and address protection were not exposed.
Citing broadcaster TV 2, Malwarebytes reported that the password was linked to a former Pays employee and had appeared in an earlier data leak. Pays offers address updates and "CPR cleansing" services that check customer records against the register.
According to documents obtained by TV 2, the attacker gained access on 10 September and ran about 14 million automated searches up to 20 September. The intrusion was detected on 2 October, 12 days after the last searches.
Access by design
The register's core systems were not penetrated. Section 38 of Denmark's Civil Registration System Act lets private businesses with a legitimate interest obtain CPR data. It applies to people they have identified individually in advance. Recipients must also be entitled to process the data under the GDPR.
The ministry said the searches stayed within the categories of information private companies are allowed to access. The Register said it had asked the ministry why such broad access was granted.
Minister Christina Egelund has briefed the Danish parliament's business and digitalisation committee and asked for a thorough security review of the CPR system. The ministry said measures to prevent similar incidents were already under way.
Egelund said it was too soon to say whether Denmark would issue new CPR numbers, The Register reported. Danish security specialist Jan Kaastrup told TV 2 that treating CPR numbers as secrets was "broken". He said a number alone should not be accepted as proof of identity.
The Danish Data Protection Agency, Datatilsynet, was notified on 4 October and police are investigating. The ministry said it was too early to say who was behind the attack.
Malwarebytes' Pieter Arntz wrote that the weak password was remarkable, "but the failure to spot millions of unusual searches made the breach worse."
He said systems that give access to sensitive data should reject weak passwords and make multi-factor authentication mandatory.
"That many searches from one account should have been noticed earlier," he wrote.