`123456' password used in Danish CPR data breach

Original Article ↗ Hacker News Discussion ↗

A massive breach of Denmark’s national civil registry (CPR) is drawing scrutiny after attackers allegedly accessed the system using an admin account protected by the password “123456.” Commenters argue that while the trivial password and lack of multi-factor authentication are egregious, the deeper problem is systemic: critical identity numbers are widely reused for both identification and quasi-authentication, third-party access is poorly controlled, and monitoring only reacted when billing anomalies appeared. Many call for stronger regulation, auditing, and the treatment of CPR-like identifiers as public IDs rather than secrets, noting that otherwise similar failures are inevitable.

Scope of the Breach & CPR Context

  • CPR is Denmark’s 10-digit personal ID, comparable to a US SSN; it encodes birthdate and sex and is widely used for identification.
  • Many commenters argue CPR (and similar national IDs) should be treated as public identifiers, not secrets or authentication factors.
  • Some compare with Sweden and Norway, where personal numbers or related data are more public and authentication relies on cryptographic systems and national single sign-on, not the ID itself.

Immediate Technical Failures

  • The compromised account belonged to a tiny third-party company (two employees).
  • The password was “123456”; there was reportedly no MFA and very weak or absent password policies.
  • The account was tied to a former employee and apparently was not disabled, indicating poor offboarding and account lifecycle management.
  • Abuse went on for ~21–22 days and was only detected because the billing volume spiked, implying no effective rate limits, anomaly detection, or access monitoring.

Broader Systemic Issues

  • Many argue the root problem is not just the weak password, but:
    • Granting a small company broad access to a critical registry with minimal oversight.
    • Lack of least-privilege design and download limits.
    • Long-known structural flaws in CPR usage that have been “papered over” for years.
  • Some suggest regular audits of third parties, PCI-style, and stronger baseline requirements (MFA, monitoring, access controls).

Security vs Productivity & Usability

  • Debate over whether security and productivity are inherently in tension:
    • One side claims people naturally bypass controls (e.g., simple passwords) to get work done.
    • Others counter with examples (SSO, password managers, passkeys, FDE) where security and usability both improve.
  • Frustration with overzealous or poorly designed corporate security that blocks password managers or enforces unusable policies is contrasted with this case, where almost no safeguards existed.

Accountability, Culture, and Governance

  • Calls for stronger accountability ranging from better regulation and “software building codes” to severe legal penalties; others warn about criminalizing honest mistakes.
  • Repeated concern that organizations scapegoat low-level individuals instead of fixing systemic design and governance failures.

Tone & Reactions

  • Mix of outrage, resignation (“not even surprising anymore”), and dark humor, including many references to “Spaceballs” and joke passwords.