How The World’s Most Common Password Allegedly Exposed 8.8 Million People’s Data

The breach occurred when cybercriminals gained unauthorised access to Denmark's Central Person Register (CPR) by exploiting credential leaks tied to an authorised IT vendor, according to Danish news outlet Politiken.

Authorities confirmed that the underlying civil system itself was not directly hacked.

Instead, the attackers abused legitimate access privileges granted to Pays ApS, a technology firm based in Odense that provides address updates and data verification services.

Shockingly, the compromised accounts relied on '123456', a password frequently ranked among the weakest in the world.

This severe gap in basic digital security allowed attackers to quietly log in and execute roughly 14 million automated search queries over 10 days starting 10 September.

The stolen data includes full names, home addresses, and personal identification numbers.

Reports indicate the breach exposed details belonging to roughly 5.5 million living citizens and 3.3 million deceased records.

The massive leak was finally uncovered on 2 October, when an alert administrator within the digitalisation ministry noticed an abnormally high routine billing statement generated by the millions of automated API queries.

Authorities immediately revoked the vendor's access credentials on the same day.