A Danish IT service provider, Pays ApS, was hacked using the astonishingly weak password ‘123456’, allowing a hacker to access the national population registry and extract personal data of 8.8 million people, effectively the entire population of Denmark. The attack, which took place from September 10 to 20, enabled approximately 14 million automated searches in the registry. The compromised data includes names, addresses, and CPR numbers, the personal identifiers assigned to residents. The breach was only detected on October 2, twelve days after the last intrusions, thanks to an unusually high bill. Malwarebytes noted that such weak protection should have been automatically rejected and emphasized the importance of multifactor authentication.
Source: Read the original article
