
一名声称对丹麦中央人员登记系统(CPR)泄露事件负责的人表示,他们通过一家 IT 公司的账户获得访问权限,该账户受密码“123456”保护。
A person claiming responsibility for the breach of Denmark's Central of Persons (CPR) says they gained access through an IT company's account protected by the password "123456."
该人告诉丹麦新闻媒体《Politiken》,他们没有出售或泄露数据的意图。
The person told Danish news outlet Politiken they had no intention of selling or leaking the data.
该报报道称,至少有三个公司账户,包括一个管理员账户,使用了相同的密码。
The newspaper reported that at least three company accounts, including an administrator account, used the same password.
丹麦 CPR 管理局于 10 月 5 日确认了一起泄露事件,影响了 880 万人的信息,并补充称,一家丹麦公司对 CPR 系统的合法访问被滥用。
Denmark's CPR administration confirmed a breach affecting the information belonging to 8.8 million people on October 5, adding that a Danish company's legal access to the CPR system was abused.
他们未点名位于菲yn 的 Pays ApS 为涉事公司,但该公司董事总经理 Sophie Laursen 于 10 月 9 日确认其访问权限被利用。
It did not name Funen-based Pays ApS as the company in question, but managing director Sophie Laursen confirmed on October 9 that it's access had been exploited.
Pays 的网站已下线,且该公司未回应《The》就密码主张提供更多信息的请求。
Pays' website has been taken offline, and the business has not responded to The's request for more information about the password claims.
Pays 获得了对 CPR 系统的授权访问,以提供诸如验证企业客户记录之类的服务。丹麦政府表示,880 万人的信息被访问。
Pays had authorized access to the CPR system to provide services such as validating business customers' records. The Danish government says information relating to 8.8 million people was accessed.
CPR 系统包含约 1100 万条记录,其中包括已故人士和移居国外人士的记录。政府未就所谓的密码失误问题作出回应。
The contains approximately 11 million records, including those of deceased people and people who have moved abroad. The government did not respond to questions about the alleged password failings.
根据广播电视台 TV 2 获得的文件,攻击者于 9 月 10 日获得 CPR 系统访问权限,并在 9 月 10 日至 9 月 20 日期间进行了 1400 万次自动搜索。
According to documents obtained by broadcaster TV 2, the attacker gained access to the CPR system on September 10 and ran the 14 million automated searches between then and September 20.
入侵于 10 月 2 日被发现,较最后一次报告的搜索晚 12 天。
The intrusion was detected on October 2, 12 days after the last reported searches.
政府高等教育和科学部门主管 Mikkel Leihardt 在新闻发布会上告诉记者,攻击是在一名部门工作人员发现一张来自 Pays 的异常高活动发票后被发现的。
Mikkel Leihardt, director of the government's higher education and science ministry, told reporters at a press conference that the attack was discovered after a department staffer picked up an invoice indicating unusually high activity from Pays.
丹麦数据保护局 Datatilsynet 于 10 月 4 日获悉此事,政府次日公开了此次攻击。
The Danish data protection authority, Datatilsynet, was notified on October 4, and the government disclosed the attack the following day. ®