重點資訊
Denmark's Central Register of Persons (CPR) recently confirmed a significant data breach occurring in September. The incident exposed the personal information, including names, addresses, and ID numbers, of 8.8 million living and deceased individuals.
A self-identified attacker claims they gained unauthorized access to the CPR through a private Danish firm named Pays ApS. The breach reportedly involved using the password '123456' on an administrator account, one of three accounts held by the firm that allegedly shared this identical, insecure credential.
The unauthorized access began on September 10, leading to 14 million automated searches of the database over ten days. The activity remained undetected until October 2, when an employee at the Ministry of Research, Education and Digitalisation identified an unusually high invoice generated by the firm's account.
While the individual claiming responsibility for the attack stated they do not intend to sell or leak the stolen data, the event serves as a stark reminder regarding poor password management practices. The incident highlights how easily accessible systems can be compromised when basic security protocols are ignored.
