A report published October 13 says documents obtained by Danish broadcaster TV 2 link a breach involving Denmark’s Central Register of Persons to the use of the password “123456.” The report says the attacker accessed the system in September and conducted millions of automated searches, highlighting how a weak access-control decision can have outsized consequences in systems holding population-scale personal data.
The available reporting is developing, but the defensive lesson is clear: privileged and service access needs controls that do not depend on password strength alone. Sensitive registries should enforce phishing-resistant multi-factor authentication, remove shared accounts, apply rate limits and anomaly detection to high-volume queries, and routinely review access paths for legacy credentials.
Preserve authentication and query logs, establish thresholds for unusual bulk access, and rehearse notification and containment processes. A compromised credential should not enable unrestricted data access.