"123456"

Denmark CPR Registry Breach

Mutahar reports that Denmark’s CPR registry, which is used for many everyday services and is comparable in some ways to a Social Security number system, was exposed through a breach involving APS Pays, a company authorized to search the registry.

According to the report, an attacker used a leaked employee password, “123456,” to make roughly 14 million automated searches over about 10 days. Around 8.7–8.8 million records were reportedly accessed, potentially exposing CPR numbers, names, and addresses. The exact method and password were not fully confirmed.

The breach was reportedly discovered after APS Pays’ accounting department questioned an unusually large bill for searches. Mutahar criticizes the lack of security monitoring that might have flagged the volume of requests sooner. Authorities reportedly revoked the company’s access and began investigating. People with name-and-address protection were said not to have been included.

Security Implications

Mutahar says the incident highlights the risks of giving third-party companies access to sensitive government data: weak security at a vendor can have consequences similar to a direct government breach. He argues that stronger passwords, additional authentication, and better monitoring could help prevent or detect such incidents.

He contrasts the breach with growing concerns about AI-assisted cyberattacks, saying this incident appears to have resulted from basic human negligence rather than an advanced hack or autonomous AI. He also mentions a separate North American driver’s-license data breach as another example of sensitive information being exposed through a government-linked service provider.

Contributors

• Presenter: Mutahar (Muta)
• Other contributors: None identified