Please, please, please do not use '123456' as any kind of password. I know that may seem obvious, but apparently it bears repeating if a recent hack of Denmark's Central Register of Persons (CPR) is anything to go by.
To recap, the CPR administration said earlier this month that it had become aware of a breach that took place in September (PDF warning). This exposed personal details—names, addresses, ID numbers—of 8.8 million people, both living and deceased. It was confirmed at the time that the legitimate access of a private Danish firm had been exploited by the attacker.
A person claiming responsibility for the attack has come forward this week. Not only that, they say that they gained access to the CPR via an account which had the password '123456'. According to Danish newspaper Politiken, this was one of three accounts held by the private firm with that same password. One of these was an administrator account. Talk about a cybersecurity boo-boo.
The self-identified attacker claims they have no intention of leaking or selling the data they lifted, so that's something. Still, we're left with the uncomfortable reminder that those who should know better don't always have the best password management.
The Danish firm at the heart of this attack has been identified as Pays ApS. This company was granted access to the CPR in order to provide various services, like validating business customers' records.
The self-identified attacker gained access to the Pays ApS account on September 10, and then ran 14 million automated searches of the CPR between then and September 20. The attack was only discovered on October 2 when an employee at the Ministry of Research, Education and Digitalisation noticed an unusually high invoice, which indicated that many more searches than the norm were being made by Pays ApS.
Hackers are all too aware of the most common passwords, with '123456' often bafflingly popular among them. Bottom line, now might be a good time to update your passwords to something uniquely yours or to otherwise investigate password tools (though not even something like a password manager is completely air tight).
Not every hacker is rocking a password cracking rig with 12 Nvidia GeForce RTX 5090s—for instance, I was particularly charmed by the password-cracking Game Boy Advance that is 'about thirty million times slower than a modern cracking rig'. But if your password is '123456', a hacker won't need hardware any more dedicated than their brain to crack open your account like a coconut.