Pays accounts used "123456" during Danish civil registry breach

At least three accounts at Danish IT company Pays used the password "123456" when hackers accessed Denmark's central civil registration database, Politiken reported, including an administrator account. The breach exposed information linked to around 8.8 million CPR numbers, which identify people living or previously registered in Denmark. Pays confirmed on Friday that attackers abused its authorized access to the register. The hacker had access from 10 September for 21 days and 17 hours. An anonymous hacker claimed entry began with a leaked former employee's password and that two programs retrieved and stored registry information externally. Those claims do not establish that the weak passwords identified by Politiken were the initial entry point.