How The World’s Most Common Password Allegedly Exposed 8.8 Million People’s Data
The password is so common, it might just be your password too.
Cover image via Follow us on Instagram, TikTok, and WhatsApp for the latest stories and breaking news.
A basic security oversight has led to a catastrophic data leak in Denmark, compromising sensitive personal details of approximately 8.8 million living and deceased individuals
The breach occurred when cybercriminals gained unauthorised access to Denmark's Central Person Register (CPR) by exploiting credential leaks tied to an authorised IT vendor, according to Danish news outlet Politiken.
Authorities confirmed that the underlying civil system itself was not directly hacked.
Instead, the attackers abused legitimate access privileges granted to Pays ApS, a technology firm based in Odense that provides address updates and data verification services.
Investigations revealed that former company credentials had previously appeared in wider online database dumps
Shockingly, the compromised accounts relied on '123456', a password frequently ranked among the weakest in the world.
This severe gap in basic digital security allowed attackers to quietly log in and execute roughly 14 million automated search queries over 10 days starting 10 September.
The stolen data includes full names, home addresses, and personal identification numbers.
Reports indicate the breach exposed details belonging to roughly 5.5 million living citizens and 3.3 million deceased records.
Despite the staggering volume of requests, the intrusion went undetected by security monitoring systems for more than three weeks
The massive leak was finally uncovered on 2 October, when an alert administrator within the digitalisation ministry noticed an abnormally high routine billing statement generated by the millions of automated API queries.
Authorities immediately revoked the vendor's access credentials on the same day.
