Danish national register breach exposes 8.8 million via weak vendor password

Eight point eight million people in Denmark have had their personal information accessed following a security failure at a small IT vendor. The breach involved the Central Register of Persons, a government database containing sensitive citizen data. According to The Register, the incident stems from weak credential management at the vendor level rather than a direct attack on government infrastructure.

How did the attacker gain access?

A person claiming responsibility for the breach told Danish news outlet Politiken that they entered the system using the password '123456'. This credential protected accounts at Pays Ap S, a Funen-based IT company that held authorised access to the national register. The newspaper reported that at least three company accounts, including an administrator account, shared this simple password.

What data was involved?

The Danish government confirmed that information relating to 8.8 million people was accessed on October 5. The Central Register of Persons holds approximately 11 million records in total, which includes data on deceased individuals and those who have moved abroad. Pays Ap S used this access to validate business customers' records as part of its service offerings.

When was the breach discovered?

Documents obtained by broadcaster TV 2 indicate the attacker gained entry on September 10 and conducted 14 million automated searches until September 20. The intrusion was not detected until October 2, twelve days after the last reported searches. Mikkel Leihardt, director of the government's higher education and science ministry, stated the attack was discovered after a staffer noticed an invoice showing unusually high activity from Pays.

What is the current status?

Pays Ap S managing director Sophie Laursen confirmed on October 9 that the company’s access had been exploited. The firm’s website has been taken offline, and it has not responded to requests for further information regarding the password claims. The government did not respond to questions about the alleged password failings or the specific nature of the data accessed.

What affected people can do

Individuals should monitor their financial accounts and credit reports for unauthorised changes or new enquiries. Check email and postal mail for unexpected password reset requests or verification codes, as attackers often follow data exposure with targeted phishing attempts. Verify any communications claiming to be from government bodies or banks by contacting them directly through official channels, rather than clicking links in unsolicited messages.

What to do and how to stay safe: Pays Ap S

• Review recent login activity on all personal accounts for unfamiliar devices or locations.
• Enable multi-factor authentication on email and financial accounts to add a layer of security.
• Be wary of unsolicited messages asking for personal verification details following publicised breaches.
• Once the vendor provides an update, check for specific guidance on affected data fields.

Step-by-step guide: Identity Theft Protection: Answers to Critical Security Questions

General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which company was responsible for the security failure?

Pays Ap S, a Funen-based IT company, had its authorised access to the Central Register of Persons abused.

Did the attacker sell the stolen data?

The person claiming responsibility told Politiken they had no intention of selling or leaking the data.

How many searches were performed during the breach?

The attacker ran 14 million automated searches between September 10 and September 20, according to TV 2.