Denmark's national population register breached — 8.8 million records exposed via '123456' password
·CredentialsCritical
An attacker ran 14 million automated searches against Denmark's Central Person Register (CPR) in September using an IT company's account protected by the password '123456', exfiltrating names, addresses and ID numbers for virtually the entire Danish population.
Deception angle
Third-party account credentials are a primary initial access vector. A decoy identity provider or a fake internal API endpoint would catch the automated bulk-query pattern immediately — 14 million searches in 10 days is an unmistakable signal that no real user should generate.
Read about Kandaro Deception, or browse more security news.