security A field note by Vikrant Sharma
Denmark's social security database got breached with password 123456
A contractor left Denmark's CPR registry exposed with the literal password '123456'. Five million people. One dictionary attack.
Denmark’s CPR system holds every citizen’s social security number, address, and birthdate. Someone protecting that database chose ‘123456’ as the password. Five million records exposed. The breach happened at a contractor handling the data, not the central registry itself, but the damage is the same. This is not a zero-day exploit. Not a supply chain compromise. Not even a phishing email. Someone typed six digits into a password field and walked into a national identity database. The kind of breach that makes every penetration tester want to retire because reality keeps stealing their demo scenarios. The Danish government is now mandating hardware security keys for all systems touching CPR data. That is the correct response, but it raises the question of why this was not the baseline before. Social security numbers are not user-generated content. They are not log files. They are the keys to every government service, every bank account, every medical record. Password policies are not enough when the policy is not enforced. The contractor presumably had guidelines. They had a security audit somewhere in the procurement process. None of it mattered because someone with database access could still set ‘123456’ and nobody noticed until the breach was public. The fix is not better password training. The fix is architecture that makes this impossible. Single sign-on with hardware tokens. Certificate-based authentication. Zero-trust network access where the password field does not exist. Denmark is moving that direction now. Every other country with a centralised identity system should be auditing their contractor access this week.