The disastrous password compromised the information of 8.8 million people / the story of intrusion into the identity system of users

A two-employee tech company became a major security vulnerability by using the simple password "123456"; An event that has once again highlighted the risk of giving access to sensitive data.

The password "123456", which has been on the list of the world's most common and most insecure passwords for years, reportedly gave hackers access to the personal information of around 8.8 million people in Denmark. At least three user accounts in the small information technology company Paiz have been linked to this security breach; A Danish company that had only two employees according to the information registered in July 1405. This unauthorized access has put the information related to Danish central registration numbers at risk; A system that maintains the identity information of about 11 million people, including current residents, people who have migrated abroad, and the deceased. According to reports, the company's account managers used the simple password "123456"; The password that hackers usually try to enter accounts is one of the first options.

On Friday, October 18, 1405, Paiz confirmed that the company's access to the Danish civil registry system had been misused. The CEO and owner of the company announced that the company's legal access to search for information in this system was used in an unauthorized way. An unknown hacker also claimed on Thursday, October 17 that he was responsible for this attack and that entering the system was not difficult. According to this hacker, the story started with the disclosure of the password of a former employee of a small Danish company. The attacker then used this access to enter the system and by creating two computer programs, he extracted the information and stored it outside the system. This hacker has claimed that he did not intend to sell or publish the information. The reported access started on September 19 and continued for 21 days and 17 hours.

But why did a company with only two employees have access to such vast information? The Danish civil registration system is used to identify individuals interacting with government institutions and private companies. Different organizations, to check the address of customers or manage their members' records, can get a limited access license to the information of this system. This mechanism makes administration easier, but at the same time makes the security of millions of people's information partially dependent on the security practices of the licensee companies. Despite the wide dimensions of this security breach, the disclosure of the civil registration number alone does not mean that hackers have direct access to the citizens' digital identity; Because Denmark uses the two-step authentication system "MetID". However, cybercriminals can use these numbers to design fake and more believable messages, calls, and emails, or combine the information obtained with data exposed in previous attacks to gain a more detailed understanding of victims.