Registry Security Breach
A person claiming responsibility for the recent breach of Denmark’s national registry stated they gained access due to weak credentials utilized by an IT provider. According to reports, Pays ApS, an IT and data services firm that allows customers to reference the Danish Central Register of Persons (CPR), served as the entry point, with the intruder stating that an exploited account was secured by a '123456' password.
Copenhagen confirmed the security incident, noting that officials discovered the breach 12 days later when an invoice highlighted unusual activity levels from the company. The Danish government reported that 8.8 million records were retrieved, though the hacker stated they do not plan to sell or leak the data. While officials initially omitted the company's name, Pays ApS managing director Sophie Laursen confirmed that the perpetrator utilized the firm's database access to extract the records.
Third-Party Vulnerabilities
The event highlights that system security depends on third-party access controls, with the national database compromised via a poorly secured external account. Given that the CPR contains records on virtually all Danish citizens, critics note it should enforce stronger authentication standards. Previous government database incidents include an Indonesian ransomware attack in 2024 affecting over 230 public agencies without backups, and a South Korean data center fire last year.
Observers anticipate the Danish government will revise authentication requirements, particularly as automated tools facilitate faster cyberattacks. Recent threats against government and financial infrastructure have increasingly leveraged automated systems. However, in cases involving basic credentials like '123456', advanced intrusion tools are unnecessary to compromise vulnerable systems.
