The person who claimed responsibility for a massive data breach from Denmark’s Central Register of Persons (CPR) said he gained access through an IT company account that was protected by the combination “123456.” According to media reports, this primitive password was used on three of the contractor’s accounts, including the administrator’s.
The person who claimed responsibility for a massive data breach from Denmark’s Central Register of Persons (CPR) said he gained access through an IT company account that was protected by the combination “123456.” According to media reports, this primitive password was used on three of the contractor’s accounts, including the administrator’s.
The attacker said he had no intention of selling or publishing the stolen data, and his goal was to demonstrate the weakness of the security system, The Register reports .
According to documents obtained by TV 2 journalists, the timeline of the cyberattack is as follows. Between September 10 and 20, the hacker gained access to the CPR system and made about 14 million automated requests, but the intrusion was only discovered on October 2, 12 days after the attack, when an employee of the Danish Ministry of Higher Education and Science noticed anomalous activity in an invoice from a contractor. As a result, on October 4–5, the Danish Data Protection Agency was officially notified of the incident and the fact of the large-scale leak was publicly disclosed.
The CPR administration confirmed that the attackers used legal access from one of the commercial companies. In total, the attack affected the data of 8.8 million people (in total, the registry contains about 11 million records, including those who died and those who went abroad).
Although the government did not officially name the source company, Sophie Laursen, the director of Funen-based Pays ApS, confirmed that the attackers used their commercial access. Pays ApS provided services for verifying business customer data in the CPR register.
The Pays ApS website is currently completely down, and the company's management has refrained from commenting on the claim of using the password "123456." The Danish government has also not yet responded to journalists' inquiries about the failure in the contractor's password policy system.
