Please, please, please do not use '123456' as any kind of password. I know that may seem obvious, but apparently it bears repeating if a recent hack of Denmark's Central Register of Persons (CPR) is anything to go by.

To recap, the CPR administration said earlier this month that it had become aware of a breach that took place in September (PDF warning). This exposed personal details—names, addresses, ID numbers—of 8.8 million people, both living and deceased. It was confirmed at the time that the legitimate access of a private Danish firm had been exploited by the attacker.

A person claiming responsibility for the attack has come forward this week. Not only that, they say that they gained access to the CPR via an account which had the password '123456'. According to Danish newspaper Politiken, this was one of three accounts held by the private firm with that same password. One of these was an administrator account. Talk about a cybersecurity boo-boo.

The self-identified attacker claims they have no intention of leaking or selling the data they lifted, so that's something. Still, we're left with the uncomfortable reminder that those who should know better don't always have the best password management.

The Danish firm at the heart of this attack has been identified as Pays ApS. This company was granted access to the CPR in order to provide various services, like validating business customers' records.

The self-identified attacker gained access to the Pays ApS account on September 10, and then ran 14 million automated searches of the CPR between then and September 20 .

Source link