News for hackers. Stuff that matters.

A comment on `123456' password used in Danish CPR data breach. Parent comment

Re:`123456' password used in Danish CPR data breach by ptnpzwqd on Saturday October 10, 2026 @09:06AM (#50032557)
I think you mean that isn’t how they are meant to be used. If that was consistently the case in practice, however, no one would talk about this leak (at least not the CPR number part of it).

I doubt the CPR number alone will give you access to obtain credit and the like today, but you can absolutely go into a pharmacy and buy someone’s prescription medicine with just their CPR number, and you for sure can get access to a lot of data by calling various entities and providing your CPR number as proof of identity (but at least fewer now than used to be the case in the past).

If the CPR number was truly made public information, those cases would be much more obviously wrong. The fact that CPR numbers are de facto considered pseudo-secret makes things much worse.

[ Parent | on HN ]
Re:`123456' password used in Danish CPR data breach by ninalanyon on Saturday October 10, 2026 @05:15PM (#50037263)
> you can absolutely go into a pharmacy and buy someone’s prescription medicine with just their CPR number

In Norway I have to show photographic ID and my fødselsnummer.

[ Parent | on HN ]
Re:`123456' password used in Danish CPR data breach by boxed on Sunday October 11, 2026 @10:28PM (#50050601)
> but you can absolutely go into a pharmacy and buy someone’s prescription medicine with just their CPR number

You for sure can't do this in Sweden. I very much doubt Denmark has gone total nutjob on this part, but if you have some proof they do please present it.

> If the CPR number was truly made public information,

In Sweden I can just call up the tax office and ask for the person number of anyone. A colleague was as confused about this as you are and he ended up intending to "prove me wrong" by doing it. They gave him my person number. Which of course they did. That's what it's for.

[ Parent | on HN ]
Re:`123456' password used in Danish CPR data breach by ptnpzwqd on Monday October 12, 2026 @03:15AM (#50052508)
Yes, but Sweden and Denmark have been very different in their approach to personal numbers, and a lot of us here in DK are looking at the Swedish model as an example of how this _should_ work.

I am not sure what evidence you are looking for, but I have myself picked up prescription medicine using nothing but my CPR number on multiple occasions, including picking it up on behalf of my wife (providing just her CPR number and name).

[ Parent | on HN ]