Denmark is investigating a major data breach involving its national population database. The incident reportedly exposed personal information belonging to approximately 8.8 million people.
The breach affected Denmark’s Central Register of Persons (CPR), which stores essential personal details. These include names, home addresses, and identification numbers.
According to reports, a hacker allegedly accessed the database using an account linked to a private IT company. The attacker reportedly used the simple password “123456” to gain access.
However, Danish authorities have not confirmed the claim about the password. Investigators are examining the incident to establish how the unauthorized access occurred.
Private IT Company Account Linked to Breach
Reports by Danish newspaper Politiken linked the breach to Pays ApS. The company is authorized to access the national database for customer verification services.
Businesses use these services to verify customer information. However, the company’s database access was allegedly misused during the incident.
Pays ApS Managing Director Sophie Laursen confirmed on October 9 that the company’s access had been misused. The reported breach involved at least three company accounts.
According to the reports, those accounts shared the same password. One of them reportedly belonged to an administrator, raising concerns about account security.
The shared password may have increased the risk of unauthorized access. However, the precise method used by the attacker remains subject to investigation.
Millions of Automated Searches Reported
Documents obtained by Danish broadcaster TV 2 reportedly showed extensive activity during the breach. The attacker allegedly conducted around 14 million automated searches between September 10 and September 20.
The unusual activity was discovered on October 2. A government employee noticed an invoice showing an unusually high volume of activity associated with the company.
The incident was subsequently confirmed by Danish authorities on October 5. Officials said the affected information belonged to approximately 8.8 million people.
Denmark’s national population database contains around 11 million records. These include information about deceased individuals and people who have moved abroad.
The scale of the reported activity has raised concerns about protecting sensitive information. The investigation will help determine the full extent of the unauthorized access.
Authorities Investigate Data Security Incident
The Danish Data Protection Agency was notified about the breach on October 4. The government publicly disclosed the incident the following day.
The individual claiming responsibility told Politiken they had no plans to sell or release the information. However, authorities have not independently verified this claim.
Officials have blocked Pays ApS from accessing the national database. Police are also investigating the incident to determine how the breach happened.
The case highlights the risks associated with weak passwords and shared account credentials. It also raises questions about access controls for organizations handling sensitive personal information.
In other related news also read US and Denmark Reach Greenland Security Agreement
Denmark’s investigation will be important in establishing how the attacker gained access and whether additional security measures are needed. Authorities have not yet confirmed all details surrounding the incident.
