The World's Worst Password Led to the Theft of 9 Million People's Personal Data

One of the world's most common and easily guessed passwords, “123456,” reportedly led to the theft of personal data belonging to 8.8 million people in Denmark. The password was allegedly used for administrator accounts.

Denmark's Central Person Register (CPR) came under scrutiny following a cyberattack in September. It was confirmed that data belonging to millions of individuals had been compromised, including records of both living and deceased persons. The individual claiming responsibility for the attack alleged that access was gained by exploiting extremely weak passwords used by accounts belonging to an IT company. According to these claims, at least three accounts, including an administrator account, were protected by the password “123456.”

8.8 Million People's Data Accessed Using the Password “123456”

The cyberattack targeting Denmark's national population registry reportedly involved Pays ApS, an IT and data services company with authorized access to the CPR database. The company was permitted to access the system to provide services such as verifying its customers' business records.

The individual claiming responsibility told the Danish news outlet Politiken that the same weak password was used across at least three company accounts.

Danish authorities confirmed that the names, addresses, and identification numbers of 8.8 million people had been compromised. The affected records included both living and deceased individuals.

The government explained that the attacker had targeted a private company with authorized database access rather than directly compromising government systems.

The Attack Continued for 10 Days

According to documents, the attacker performed approximately 14 million automated queries against the CPR system between September 10 and 20. The unusually high volume of queries played a significant role in detecting the attack.

The suspicious activity was not initially identified by the department directly responsible for managing the CPR system. Instead, an employee of Denmark's Ministry of Research, Education and Digitalisation noticed that the number of queries performed by Pays ApS was significantly higher than normal.

This observation prompted an investigation into the company's database access activities.

The individual claiming responsibility stated that they did not intend to sell or publish the stolen information online. However, this statement does not guarantee that the information has not reached other parties or that the data remains secure.

One of the World's Most Common Passwords

“123456” has consistently ranked among the most commonly used passwords worldwide.

According to NordPass data, this password has been used more than 21 million times. Other frequently used passwords include “admin,” “12345678,” and “123456789.”

At a time when the use of artificial intelligence-powered tools in cyberattacks is receiving increasing attention, weaknesses in fundamental security measures are creating even greater risks.

Using stronger passwords has become essential for both individuals and organizations. However, even the strongest password cannot guarantee complete protection. Password security also depends on the awareness and vigilance of the people who use them.

Some of the Measures We Should Take to Protect Against Such Attacks Include;

• Strong and unique passwords should be used, while common and easily guessable passwords should be prohibited.

• Multi-factor authentication (MFA) should be mandatory, particularly for administrator accounts and critical systems.

• Privileged accounts should be managed through PAM solutions, and access should be restricted according to the principle of least privilege.

• Unused accounts should be disabled, while service accounts and third-party access permissions should be regularly reviewed.

• Unusual login attempts and high-volume data queries should be monitored through SIEM solutions, with alerts generated for suspicious activities.

• Access logs for critical systems should be reviewed regularly, and appropriate data loss prevention controls should be implemented.

  
  

For more information, please contact our experts at info@zerosecond.ae.