The password that opened 8.8 million Danish identity records was 123456

Every list of worst passwords ever published has 123456 at or near the top. Last week it turned out to be the key to Denmark's Central Person Register.

The register, known as CPR, holds the name, address and ten-digit identity number of everyone in the country. It is not open to the public, but companies can be granted lawful access to look records up. One of them was Pays ApS, a small outfit in Odense that as of July this year employed two people. Danish reporting says at least three Pays accounts used 123456, including an administrator account, and that the credentials belonged to a former employee and had already surfaced in an earlier data leak. Somebody logged in and started running automated lookups. Roughly 14 million of them. Nobody noticed until an unusually large bill arrived and an employee went looking, on 2 October.

The haul covers around 8.8 million people, about 5.5 million living and 3.3 million dead, which is most of the country. Digitalisation minister Christina Egelund has conceded that the security measures were not good enough and ordered a review of the whole system. A Danish security professor's verdict on the password was "hopeless", which is hard to argue with. No money moved, but names and verified home addresses are exactly what makes a scam message land, so Danes should expect convincing post for a long while.

The lesson is older than the breach. One weak or recycled password on an account nobody is watching can reach further than anything else on the network. Tendvane's privacy and accounts check looks at how the accounts on your own PC sign in, and tells you which ones are still standing on a password alone.