Facepalm: It's no secret that the most popular passwords in the world are the worst. You'd be forgiven for assuming their use is limited to the less tech-savvy, but a hacker claims to have breached Denmark's Central Register of Persons (CPR) via an IT company whose account used the password "123456."
Number sequences starting with 1 dominate lists of the most common passwords – there were ten of them in last year's top 20. The most popular of them all topped the list: "123456."
The person who breached Denmark's CPR told regional news outlet Politiken that at least three company accounts, including an administrator account, used the same awful password.
The CPR administration recently confirmed that a data breach took place in September, exposing names, addresses, and ID numbers of 8.8 million people, both living and deceased. It also confirmed that the hacker had accessed a private Danish firm to exploit its legitimate access.
While the government agency never named the company that had been targeted, Pays ApS managing director Sophie Laursen said on October 9 that its access had been exploited.
Pays ApS had used its authorized access to CPR systems to provide services such as validating business customers' records, writes The Reg. Its website has since been taken offline.
The hacker has claimed that they don't intend on selling the stolen information or leaking it online, which, assuming it's true, will likely be a relief for Pays ApS.
According to documents seen by TV2, the attacker ran 14 million automated searches of the CPR between September 10 and September 20.
It was a different government organization that discovered the attack. A staffer at the Ministry of Research, Education and Digitalisation noticed an invoice showing that Pays ApS was conducting far more searches than usual.
Last year, around 7.6 million accounts used 123456 as a password. That's more than double the number using the second-most-popular password, 12345678. You can probably guess that number three was 123456789.
This isn't the first time this popular password has been used by a company holding sensitive data. Researchers investigating McDonald's McHire recruitment platform last year logged into a test administrator account using "123456" as both the username and password. Combined with a separate access-control flaw, this allowed them to retrieve applicants' personal information. The platform's provider, Paradox.ai, fixed the issues after the researchers reported them.