A weak administrator password was linked to a major Danish data breach that exposed information tied to approximately 8.8 million national identification numbers. At least three accounts at Pays, an IT company on the island of Funen, reportedly used the password "123456," including an administrator account. The case highlights how poor security at a company with trusted access can place a national database at risk.

Danish CPR Data Leaked Politiken's investigation revealed that a hacker shared stolen data with the newspaper, claiming the password "123456" allowed access to CPR numbers and addresses. A hacker exploited a leaked password from a former employee of a small Danish firm, subsequently creating two programs to obtain and store CPR information outside the system.

This extended period prompts concerns about whether monitoring controls could have detected repeated searches or unusual data collection before the massive exposure of millions of records. This arrangement underscores the importance of securing each approved organization, as valid credentials can provide unauthorized access to sensitive public records. The pattern resembles the Veradigm third-party data breach, where stolen vendor credentials allowed an attacker to download patient information through an approved interface.

ZeroOwl previously explored the findings of a study examining the use of passwords in RDP attacks, with "123456" appearing at the top of the list.