A hacker got access to personal data belonging to more than 8.8 million people in Denmark, and the password involved was apparently just “123456”.
The company, Pays ApS, had legitimate access to Denmark’s Central Register of Persons, which contains sensitive information like names, addresses and personal ID numbers.
According to reports, three accounts at the company were using “123456” as their password. One of them was an admin account.
The attacker used the account to make around 14 million searches in the database.
The breach wasn’t discovered immediately. It was only noticed later when an unusually large invoice showed that the company had been making a massive number of database searches.