In one of the most egregious security failures this year, a hacker reportedly compromised the personal records of roughly 8.8 million Danish people, covering virtually the entire population of the country both living and deceased, by using the ever-popular "123456" password.

The breach targeted Denmark's Central Register of Persons (CPR) which stores PII including full names, addresses, and individual identification numbers. While the national database itself maintains strict infrastructure, the weak link here was from a third-party partner that was granted legitimate API access. According to The Register, private Danish IT and data services firm Pays ApS was the entry point for the attack as it utilizes the CPR database to validate business customer records, but someone at Pays ApS apparently fell asleep during cybersecurity training.

The self-identified hacker revealed that they gained access to the database via a Pays ApS account that was secured by "123456" as the password (wah-wah). Reports indicate that the firm had altogether three accounts with this same password, one of which was administrator-level (double wah-wah). In short, the intruder breached the system on September 10 and executed approximately 14 million automated searches across the CPR database over a 10-day span.

Update your passwords frequently - Image: Szabo Viktor via Unsplash

Astonishingly, the intrusion went unnoticed by security monitoring systems for more than three weeks. It was only uncovered on October 2 when an alert employee at the Ministry of Research, Education and Digitalisation reviewed routine operational billing. The worker flagged an extraordinarily high invoice reflecting a massive, anomalous spike in database search queries originating from Pays ApS, which finally exposed the hack.

Managing director Sophie Laursen confirmed that the hacker had indeed leveraged the firm's access to extract the records. While the hacker (or hackers) responsible claims they have no intention of selling or publicly leaking the stolen records, the fallout is no doubt embarrassing for the Danish government, but should be a strong reminder to all countries: central databases are only as secure as the weakest third-party vendor granted access to it. At a time when cyber threats and AI hacking are dominating security headlines, one can not stress enough the basic importance of strong and frequent password hygiene at all levels of the chain.