SaxX reported that a hacker had accessed the Danish central registry of persons, the CPR, and retrieved data associated with about 8.8 million identification numbers. According to him, these concerned living people, deceased individuals, or those who had gone abroad, and included names, addresses, and personal numbers. The author clarified that the intrusion did not directly target the Danish state, but Pays ApS, an IT company in Odense that had legal access to the registry to verify its clients' files. He indicated that the company had only two employees. Citing the newspaper Politiken, he wrote that at least three of its accounts used the password "123456", including that of the administrator. According to SaxX's account, the hacker allegedly used a leaked password from a former employee, maintained access for 21 days and 17 hours, and carried out about 14 million automated searches between September 10 and 20. The hacker also claimed that his data recovery program had been written by an AI, that he had no particular technical skills, and that he did not intend to sell or publish the data. SaxX stated that the intrusion was only discovered on October 2, after an official noticed an abnormally high bill, as searches in the registry are paid. He added that the Minister of Digital Affairs had described the incident as "deeply serious." The author also reported that the number of citizens who activated a credit fraud alert had risen from about 250,000 to nearly 970,000 in one week. According to him, the CPR had then reminded the security rules to 1,039 companies that had access to the registry, including banks, telecom operators, law firms, unions, and insurers. Finally, SaxX estimated that the incident demonstrated the risks associated with access granted to private providers, as several African states digitized their civil registries. #Cybersécurité #Hacking #Danemark (translated)
