A hacker accessed Denmark's national ID database.
8.8 million records.
the password was "123456".
The administrator account at Pays ApS, a 2-person IT company with legal access to the country's central civil registration database used 123456 as its password.
at least three accounts did.
including the admin.
and the hacker was in for 21 days and 17 hours.
The Danish digital affairs minister called it an "extremely serious incident."
In the week after the breach became public, Danes setting up credit fraud alerts went from 250,000 to nearly 970,000.
the hacker told the newspaper Politiken the access wasn't difficult.
The CPR contains names, addresses, national ID numbers, church membership, and legal incapacitation records for 11 million people.
protected by 123456.
at a 2-person company.
that had legal access to it.