Password "123456" and a Massive Breach: Details of Cyberattack That Compromised Data of 8 Million People

A cyberattack on the civil registry system exposed identity information of about 8.8 million people. Reports point to the use of the simple password "123456" in accounts at an IT company as one possible entry point into the system.

A cyber attack on the civil registration system exposed the identity information of about 8.8 million people to unauthorized access; An event that reports indicate, the use of the simple password "123456" in the accounts of an information technology company, is one of the possible ways to break into this system.

Ambassador Arjan - Social Group: Reports indicate a massive cyber security incident in Denmark, during which the identity information of about 8.8 million people in the country's central civil registration system was exposed to unauthorized access. According to the Danish media report, the person who accepted the responsibility for this attack claimed that the use of the simple password "123456" in the user accounts of an information technology company provided access to this system.

According to the technology media report "The Register" quoting the Danish newspaper Politiken, the attacker claimed that he gained access to the Danish Central Civil Registration System through the user account of an employee of Pays ApS. However, details about the password and how it was hacked are based on the person's statements and media reports and have not been independently confirmed by officials.

Denmark's Central Civil Registration System, known as CPR, stores the identity information of people registered in the country. According to published reports, the information of about 8.8 million people has been exposed to unauthorized access during this incident.

This statistic is not limited to current residents of Denmark and includes information on deceased persons and some persons who have emigrated from this country. Name, address, and personal identification number are among the information that are mentioned in the reports as accessible data.

The person who claims to have carried out the attack told the Politiken newspaper that he used the user account of an employee of Pays ApS to enter the system. According to this claim, at least three user accounts associated with this company, including an administrative account, used the password "123456".

Pays ApS has confirmed that its legal access to the civil registration system has been abused; But this confirmation alone does not mean official verification of password details or all hacking steps.

According to the documents cited by the Danish television channel TV 2, the unauthorized access started on September 10 and the activity of the attacker continued for about 21 days. During this period, about 14 million automatic searches have been performed in the system.

Reports indicate that the suspicious activity was not detected until October 2; At this time, a government employee became suspicious after seeing an unusual bill related to the high volume of searches. The Danish authorities also announced the occurrence of this incident on October 5th.

This incident has once again highlighted the importance of protecting user accounts with access to sensitive databases. Using simple and guessable passwords, especially for administrative accounts, can increase the risk of unauthorized access.

Cybersecurity experts typically emphasize the use of unique and complex passwords, multi-step authentication, limiting user access levels, and constantly monitoring for unusual activity. In systems that store the identity information of millions of people, access control of private companies and accurate recording of account activity is also of particular importance.

The Ministry of Communications warned against the widespread use of artificial intelligence by departments for writing letters and announced that this process may lead to the exit of the country's information.

The CEO of the Infrastructure Communications Company announced that 150 to 180 thousand external security incidents and 250 to 300 thousand internal attacks on the country's communications are registered daily.

The French Ministry of Interior announced that it was the target of a heavy cyber attack. French authorities are investigating the scope of the attack and security measures to prevent disruption of services and protect data.