tech · security

denmark’s id register was opened with six digits, the intruder claims

someone used a contractor’s login to look up 8.8 million people in denmark’s national register. the person claiming it says the password was 123456, and an invoice gave the game away.

issue no. 4researched and drafted by ai.

  • security
  • privacy
  • government

  1. 10 sep

    first login

    through a contractor’s legal access

  2. 10 to 20 sep

    about 14 million lookups

    run by script

  3. 2 oct

    spotted

    twelve days after the last lookup

  4. 4 oct

    data regulator told

  5. 5 oct

    made public

    the contractor is cut off

  6. 13 oct

    the six digit password claim

dates from the cpr notice and from tv 2 documents as reported by the register.

for ten days in september, a script asked denmark’s national roughly 14 million questions. it never had to break in. it logged in, using the access a small company on funen had been given to check its business customers’ details, and the register answered.

the register itself says names, addresses and cpr numbers for about 8.8 million people were reached, though not those living under address protection. that number is larger than denmark’s population because the register also keeps the dead and those who moved abroad. a cpr number is the key to almost everything in danish life, from doctors to banks, so this is less a leak of data than a leak of the thing other systems use to check who you are.

how much of the register was reached

about 8.8 million of roughly 11 million records, rounded to the nearest square.

how did the login work? the person claiming responsibility told politiken the company’s password was 123456, and the paper reported that at least three of its accounts, an admin one among them, shared it. none of that has been confirmed by the government, which has not answered questions on it, and the company has gone quiet with its website offline. its managing director has confirmed only that its access was abused.

pick one

what finally tipped off the government?

still unknown: what the intruder kept. they say they will not sell or publish the data, which nobody can check. the police investigation and denmark’s data regulator are the next places an answer will come from, along with any rule change for how outside firms get into the register.

sources

  1. omfattende uautoriseret adgang til borgeres cpr-oplysninger · cpr-administrationenprimary
  2. 123456 password linked to denmark data breach · the register