Weak password exposes records tied to 8.8 million people
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Monday, October 12th, 2026.
A leaked password reportedly allowed unauthorized searches of Denmark’s population register through a company account with legitimate access. The account was associated with a former employee, and the password was one hundred twenty three thousand four hundred fifty six. The attackers reportedly retained access for 21 days before it was shut down. An unusually large bill for around 14 million searches helped reveal the activity.
The accessed information included names, addresses, personal identification numbers and other data tied to around 8.8 million living and deceased people. Because the searches came through an authorized company connection, the incident shows why a valid login should not automatically be treated as trusted behavior.
For leaders, third parties with access to sensitive systems need enforceable identity, offboarding and monitoring standards. For defenders, former staff accounts should be disabled promptly, weak passwords should be rejected, and abnormal query volumes should trigger investigation. Authentication and behavioral monitoring need to work together.
Review all third-party access to the register, revoke stale accounts, require strong authentication and alert on search volumes that exceed normal business use.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
