Hacker claims weak password exposed 8.8 million Danish CPR numbers

A hacker claims access to nearly 8.8 million Danish CPR numbers. CPR numbers are personal ID numbers used by all Denmark residents. This breach affects almost everyone living in Denmark.

An anonymous hacker claimed responsibility in an interview with Danish newspaper Politiken. The hacker said the breach happened on September 11. Entry occurred through a small Danish firm with access to the national registry.

A former worker left behind a leaked password. The hacker said the password was simply 123456. The hacker then wrote software to copy and store the CPR data.

The hacker’s identity remains unknown. Their account is not independently confirmed. However, the hacker sent a file containing CPR numbers to Politiken.

Politiken shared the file with IT expert Emil Hørning at Defend Denmark. Hørning said the hacker’s claims appear credible. The hacker stated they will not sell or publish the personal data.