A hacker who accessed Denmark’s national population register, compromising information on approximately 8.8 million people, reportedly exploited an IT company’s account protected by the password “123456,” according to local media.
Yeah that’s pretty bad.
At least three accounts at the company, including an administrator account, reportedly used the same password. The attacker exploited the company’s legitimate access to the government database to obtain names, addresses and national identification numbers. Danish authorities are investigating the breach.
ㅤJohn Carberry, Solution Sleuth, Xcape, Inc.:
“Upstream vendor negligence remains an immediate route to enterprise regulatory liability, particularly when core citizen data is exposed through elementary authentication failures. This incident serves as an alarming case study in how foundational security neglect invites severe operational compromise. An external contractor accessed Denmark’s national population register using the trivial password “123456,” operating in an architecture that enforced neither password complexity standards nor multifactor authentication (MFA). Compounding the breakdown, the intrusion was not uncovered by defensive telemetry or behavioral monitoring, but rather through a billing surprise when an invoice revealed unusually high database activity during the unauthorized exfiltration. Although Danish public bodies and commercial partners are subject to both the EU General Data Protection Regulation (GDPR) and the national Danish Data Protection Act, it remains to be seen whether the independent supervisory authority, Datatilsynet, will levy meaningful financial penalties and binding injunctions against state-affiliated infrastructure. Ultimately, regulatory compliance frameworks mean nothing when basic identity hygiene is ignored and automated egress monitoring is nonexistent.”
“Critical Takeaways
- Foundational identity hygiene failed at every level: Permitting the default password “123456” without enforced complexity requirements or mandatory MFA demonstrates an indefensible lack of baseline access controls.
- Invoices are not intrusion detection systems: Discovering an active data exfiltration event through a billing anomaly underscores a dangerous absence of egress rate limiting and automated query monitoring.
- Regulatory accountability faces an institutional test: While Datatilsynet wields statutory power under the GDPR and national law to impose penalties, holding public-sector infrastructure accountable will test the regulator’s enforcement independence.
“Mandating GDPR compliance on paper while allowing administrative passwords that belong on a cheap luggage lock is pure compliance theater.”
ㅤ
Phil Wylie, Senior Consultant & Evangelist, Suzu Labs:
“Cybersecurity can be complex, and there are countless security solutions and services available to help organizations protect themselves. But sometimes it’s the basics that make the biggest difference. Good security hygiene, including strong passwords, multifactor authentication, and limiting access to sensitive systems, can go a long way toward reducing risk.
“It’s hard to believe that in 2026 we’re still seeing passwords like ‘123456’ being used, especially on accounts with access to sensitive government data. Attackers don’t always need sophisticated exploits when basic security practices are overlooked.
“This incident also highlights the risks associated with third-party access. Organizations need to make sure their vendors are following security best practices because a weakness in a trusted partner’s environment can put millions of sensitive records at risk.”
ㅤ
John Strand, Owner, Black Hills Information Security:
“This is one of those stories where it’s very difficult to have a serious infosec hot take because it’s just ridiculous. We can talk about AI for defense, AI for offense, and all of the incredible advancements we’re making in computer security and vulnerability management, but all of that can be completely undone by a password of 1-2-3-4-5-6. The only thing I could think when I saw this story was, ‘That’s the same code I have on my luggage.’”
ㅤAll I have to say is “oh my God”.
123456′ password linked to Denmark breach affecting 8.8 million
Posted in Commentary with tags Denmark on October 16, 2026 by itnerdA hacker who accessed Denmark’s national population register, compromising information on approximately 8.8 million people, reportedly exploited an IT company’s account protected by the password “123456,” according to local media.
Yeah that’s pretty bad.
At least three accounts at the company, including an administrator account, reportedly used the same password. The attacker exploited the company’s legitimate access to the government database to obtain names, addresses and national identification numbers. Danish authorities are investigating the breach.
ㅤJohn Carberry, Solution Sleuth, Xcape, Inc.:
“Upstream vendor negligence remains an immediate route to enterprise regulatory liability, particularly when core citizen data is exposed through elementary authentication failures. This incident serves as an alarming case study in how foundational security neglect invites severe operational compromise. An external contractor accessed Denmark’s national population register using the trivial password “123456,” operating in an architecture that enforced neither password complexity standards nor multifactor authentication (MFA). Compounding the breakdown, the intrusion was not uncovered by defensive telemetry or behavioral monitoring, but rather through a billing surprise when an invoice revealed unusually high database activity during the unauthorized exfiltration. Although Danish public bodies and commercial partners are subject to both the EU General Data Protection Regulation (GDPR) and the national Danish Data Protection Act, it remains to be seen whether the independent supervisory authority, Datatilsynet, will levy meaningful financial penalties and binding injunctions against state-affiliated infrastructure. Ultimately, regulatory compliance frameworks mean nothing when basic identity hygiene is ignored and automated egress monitoring is nonexistent.”
“Critical Takeaways
“Mandating GDPR compliance on paper while allowing administrative passwords that belong on a cheap luggage lock is pure compliance theater.”
ㅤ
Phil Wylie, Senior Consultant & Evangelist, Suzu Labs:
“Cybersecurity can be complex, and there are countless security solutions and services available to help organizations protect themselves. But sometimes it’s the basics that make the biggest difference. Good security hygiene, including strong passwords, multifactor authentication, and limiting access to sensitive systems, can go a long way toward reducing risk.
“It’s hard to believe that in 2026 we’re still seeing passwords like ‘123456’ being used, especially on accounts with access to sensitive government data. Attackers don’t always need sophisticated exploits when basic security practices are overlooked.
“This incident also highlights the risks associated with third-party access. Organizations need to make sure their vendors are following security best practices because a weakness in a trusted partner’s environment can put millions of sensitive records at risk.”
ㅤ
John Strand, Owner, Black Hills Information Security:
“This is one of those stories where it’s very difficult to have a serious infosec hot take because it’s just ridiculous. We can talk about AI for defense, AI for offense, and all of the incredible advancements we’re making in computer security and vulnerability management, but all of that can be completely undone by a password of 1-2-3-4-5-6. The only thing I could think when I saw this story was, ‘That’s the same code I have on my luggage.’”
ㅤAll I have to say is “oh my God”.
Leave a comment »