'123456' Password Linked to Denmark Data Breach Affecting 8.8M People

Theregister

'123456' Password Linked to Denmark Data Breach Affecting 8.8M People

First seen 13 Oct 2026, 19:58 UTC • •36.9

Article Content

1 / 3

Browse articles

ThreatCluster •October 13, 2026 at 21:03 UTC

•8.8 million individuals affected by the Denmark data breach.
•Weakly protected accounts at a small IT company were exploited.
•The commonly used password '123456' was linked to the breach.

A data breach in Denmark has reportedly compromised the personal information of 8.8 million individuals. The breach is linked to weakly protected accounts at a small IT company that had access to a national register. Local media reports indicate that the breach involved the use of the commonly used password '123456'. As a result, several IT systems remain offline, causing delays in orders for affected retailers. The incident highlights ongoing vulnerabilities in data security practices, particularly concerning password management. No specific CVEs or technical details were provided regarding the breach or the systems involved. The full scope of the breach and its implications are still being assessed.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-13

Denmark data breach reported

Local media revealed that 8.8 million records were compromised due to weak account protections.

More articles in this cluster (2)

Threat Graph

12 entities, 22 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (5)

Data Breach
Phishing
Zero-day Attack
Zero-day Exploit
T1566 - Phishing

Organization (2)

Hobbs
Whistles

Malware (1)

Shai-hulud

Affected Platform (4)

Microsoft 365
Microsoft Copilot
Office 2021 LTSC
SharePoint

Relationships

Shai-hulud targets Hobbs
Shai-hulud targets Whistles
Data Breach targets Microsoft 365
Data Breach targets Microsoft Copilot
Data Breach targets Office 2021 LTSC
Data Breach targets SharePoint
Phishing targets Microsoft 365
Phishing targets Microsoft Copilot
Phishing targets Office 2021 LTSC
Phishing targets SharePoint
Zero-day Attack targets Microsoft 365
Zero-day Attack targets Microsoft Copilot
Zero-day Attack targets Office 2021 LTSC
Zero-day Attack targets SharePoint
Zero-day Exploit targets Microsoft 365
Zero-day Exploit targets Microsoft Copilot
Zero-day Exploit targets Office 2021 LTSC
Zero-day Exploit targets SharePoint
T1566 - Phishing targets Microsoft 365
T1566 - Phishing targets Microsoft Copilot
T1566 - Phishing targets Office 2021 LTSC
T1566 - Phishing targets SharePoint

Following this threat?

Track Shai-hulud and Hobbs in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

How many people are affected by the breach?

The breach has reportedly affected 8.8 million individuals.

What was the attack method used in this breach?

The breach involved weakly protected accounts, with the commonly used password '123456' linked to the incident.

What is the current status of the affected systems?

Several IT systems remain offline, causing delays in orders for affected retailers.

Continue Reading

Tensorlake npm Package Compromised by Shai-Hulud Worm On October 8, 2026, the Tensorlake npm package version 0.5.144 was compromised, delivering a credential-stealing worm known as Shai-Hulud. The malware, which was published through a compromised maintainer account, executes a preinstall hook that runs an obfuscated loader to harvest credentials from local files and CI…

Rise of Malicious npm Packages Threatens Developer Trust As of Q2 2026, Sonatype Research logged 1.8 million malicious packages, with npm accounting for 96.6% of this total. The quarter saw a surge in repository abuse, trojan-class malware, and maintainer compromises, indicating a shift towards targeting trusted developer workflows. ReversingLabs reported a specific…