Face palm: It’s no secret that the most popular passwords in the world are the worst. One might assume that their use is limited to less tech-savvy people, but a hacker claims to have broken into Denmark’s Central Register of Persons (CPR) via an IT company whose account used the password “123456”.
Number sequences that start with 1 dominate the list of the most common passwords – there were ten of them in the top 20 last year. The most popular of all was at the top of the list: “123456”.
The person who violated Denmark’s CPR told regional news agency Politics that at least three company accounts, including an administrator account, used the same terrible password.
The CPR administration recently confirmed that a data breach occurred in September that exposed the names, addresses and ID numbers of 8.8 million living and deceased people. It was also confirmed that the hacker had access to a private Danish company to exploit its legitimate access.
While the government agency never named the company targeted, Sophie Laursen, managing director of Pays ApS, said on October 9 that the access had been exploited.
Pays ApS used its authorized access to CPR systems to provide services such as validation of business customer data, writes The Reg. The website has since been taken offline.
The hacker has claimed that he has no intention of selling or revealing the stolen information online, which, if true, will likely come as a relief to Pays ApS.
According to documents seen by TV2, the attacker conducted 14 million automated searches of the CPR between September 10 and September 20.
It was another government organization that discovered the attack. An employee of the Ministry of Research, Education and Digitalization noticed an invoice showing that Pays ApS was carrying out far more searches than usual.
Last year, around 7.6 million accounts used 123456 as their password. That’s more than double the number if you use the second most popular password, 12345678. You can probably guess that number three was 123456789.
This is not the first time this popular password has been used by a company that has sensitive data. Researchers studying McDonald’s McHire recruiting platform last year logged into a test administrator account and used “123456” as both a username and password. Combined with a separate access control loophole, this allowed access to applicants’ personal information. The platform’s provider, Paradox.ai, fixed the issues after researchers reported them.
