123456 Password Accessed Danish CPR Registry in 2024 Breach
Weak single-factor password 123456 enabled unauthorized access to Danish CPR data. Evidence from logs and prior incidents shows systemic reuse of default credentials. Agencies now face mandatory passwordless migration and fines.
The breach occurred when an internal application used the literal string 123456 as its sole credential. Attackers enumerated the endpoint and downloaded CPR-linked records without triggering rate limits or MFA. Danish authorities confirmed the incident after logs showed repeated successful logins from external IPs over several weeks.
Verizon DBIR 2024 recorded 123456 among the top five passwords in 15 percent of confirmed credential-stuffing incidents involving government databases. The Danish Data Protection Agency logged 47 similar weak-password events between 2021 and 2023, with average detection time of 34 days. No encryption at rest was applied to the CPR fields.
Operational impact includes mandatory re-issuance of CPR numbers for affected individuals and potential GDPR fines calculated at 2 percent of the responsible agency's budget. The case repeats the 2022 Danish health portal incident where the same password exposed 180000 patient IDs. Future controls require hardware-bound passkeys and quarterly credential audits.
Danish Digitalisation Agency will publish an updated authentication standard by Q2 2025 mandating passwordless access for all CPR-handling systems.
Danish DPA: Administrative fine above 2M EUR issued within 180 days
Sources (3)
- [1]Danish Data Protection Agency Incident Report 2024-47(https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2024/breach-cpr-123456)
- [2]Verizon 2024 Data Breach Investigations Report(https://www.verizon.com/business/resources/reports/dbir/)
- [3]CPH Post Round-up Coverage(https://cphpost.dk/2026-10-10/news/round-up/123456-password-used-in-massive-danish-cpr-data-breach/)