The register took a joke password

The national register did not fall over. A vendor’s legal login did, and the password was a punchline.

The Copenhagen Post, citing Politiken, says at least three accounts at Pays, a Funen IT firm, were set to 123456 when someone got into Denmark’s CPR register. One of them was the administrator account. Pays’s owner, Sophie Laursen, told TV 2 on Friday that the company is the one whose legal right to search the register was abused. The access ran from 10 September for 21 days and 17 hours. The exposure is information linked to about 8.8 million CPR numbers, the civil-registration key for people living in Denmark or previously registered there. An anonymous person told Politiken on Thursday that they were behind it, that a leaked password of a former employee was the first step, and that they do not plan to sell or publish the data. Politiken says it reviewed data from the breach. I am not repeating a method.

What the hacker’s “we won’t publish” is worth

It is a sentence. It is not a deletion, and it is not a control the Danish state can enforce on a copy it does not hold. Twenty-two days of search access is not a smash-and-grab of one screen. It is enough time to decide, later, what to do with a file the speaker currently says they will sit on. “Not particularly difficult” is their color. The checkable fact is the password Politiken reports on the admin account, and the company’s own confirmation that the query right was misused.

A CPR number is the join key for everything else Danish: health, tax, address. A vendor that is allowed to look up that key is the register, for as long as the login works. Patching the government database does not close a contractor account whose password is six digits in a row. Changing it after day 22 does not unwind day 1.

If your number is in the 8.8 million, assume the row was queried. Do not assume a dump site is the next page, and do not treat the absence of a dump as safety. The person who says they will not sell it is the same person who already had the query window. The company’s letter is the incident. The joke password is why it lasted three weeks.