There's a very "child-like" (not in a good way) form of responsibility that everyone seems to lean into as they climb up - very intent-based.

I asked them to do a thing, but didn't intend the obvious consequences* so it's not my fault they occurred.

Yes I completely agree. In the local news there was focus on which company it was and that the password was 123456.

Of all the things that failed for that leak, we should focus the LEAST on the password being insecure, and the company whom had their account misused, and the most at the other end of the long line of failures.

Why was there no monitoring on a company suddenly looking up 600 people a minute, why was this only discovered when they were making the invoice?? And how was it even possible to have a password that unsafe, no two factor auth etc etc etc.

The security audit recommended changing the password to 234567, but management rejected it because it would require retraining staff

When you have bad practice and process it can erode the security discipline of everyone working within the system. Until they commit brazen crap like reusing simple passwords everywhere.

They way I see it, there needs to be enough slack in an organization and the timelines for major products for people to not do the bare minimum. When management pushes goal X, and pushes hard, everything else starts to decay, including security. People need enough time to do the things they know they should do, but don’t feel they have the time for. At least this is where I’ve seen a lot of issues arise.

The incompetence will continue as long as people can profit from it inconsequentially.

Our system now heavily reenforces lack of accountability to executives for what happens under their watch.

Investors don't lose money when these breaches happen.

This is why it won't change until those change.

Massive reorganisation will only happen if companies with poor security record go out of business, while competent ones win market share.

Otherwise shareholders do not care, because they do not have skin in the game.

Same for government staff. Unless they are explicitly fired there are no consequences of abusing the trust of public.

"I dont understand why there is not massive reorganisations in systems when things go wrong"

Because massive reorganisations can easily lead to even more things going wrong. Also most people are lazy and phlegmatic by default.

Let's also include the system itself, that allowed the account to have a password that short and apparently didn't require 2FA.

Im not in tech but still in corporate. Our store went through 6 GMs in 5 years. The problem is actually the corporate, not the new guy every 8 months who is being brought on to save the day. I think they're going to replace him again next year without addressing any of the issues on the ground.

Rome wasn’t built in a day, not did it fall in a day. In a capitalist society you can gauge overall direction and success of the society but how well the market and private enterprise is doing, and well not merely in context of maximising shareholder value but as a fundamental part of the social fabric.

> I dont understand why there is not massive reorganisations in systems

This would just replace one insecure system with another.

It is time to recognise there's no such thing as a secure connected computer. And thanks to "AI" there's no such thing even as a significant defence lead over attackers.

A major problem we have is that computer programming is not engineering as people like to say. An engineering discipline VALUES redundancy and is always designing for safety. Programming likes to think of itself as math, and deliberately choses less redundancy for the sake of convenience and speed. The classical example is how operating systems are written with languages that allow an index to be out of bounds. We now have systems that are glued together using bubble gum pretending to be safe, when they fail in the most horrible way when one of the links break.

Yeah that is a pretty weird opinion. Who cares about if he gets fired. He should be charged with criminal negligence and face prison time. Everyone is responsible for their own actions and its always possible to quit.

You are presenting a false dilemma (probably unintentionally). While security can be at odds with usability, basic measures like password generation and management are a solved problem. In fact using password manager is more convenient than typing password manually, even 123456 :)

With two people in the company, there is not a lot of room for corporate games though.

> According to Denmark’s Central Business Register, Pays ApS had two employees as of July 2026.

> It's tussle between two counter-acting forces at play.

It really doesn't have to be, and setting things up as adversarial is counter-productive. Pretending that you're "balancing" two competing alternatives when they may not even be opposed is a problem, it gets you C++ std::span, a type which was standardized to be pointlessly dangerous because hey, surely if it's less safe that will make it faster right? [Morgan Freeman's Voice: But it was not faster]

It's not that hard to enable 2fa & force password manager usage. And it's not that hard to use it. In fact a pw manager alone is much more convenient than remembering passwords. The only people I know who "can't remember their passwords and are locked out" are people who don't use the pw manager and have dogs*it passwords with tiny variants they forget. They often need multiple attempts to log in anywhere. Yeah 2fa & pw manager is a tick more complicated but it's not like it take hours, it takes minutes per day. And you protect against stuff like this. No sympathy, sorry.

Productivity and Aesthetics could also be said to be counter acting forces. Or really anything that requires contemplation. I think the problem is in how some people define "productive". Is it productive to have significant security problems which cause more work?

Sorry, if your job title implies even a smidgen of security responsibility, you deserve to be fired for "123456" as your password. The person who was an administrator would fall under this label. Besides, "If productivity is not your goal, then security is not my goal." is what results in draconic security measures, because employees can't be trusted AT ALL. I really don't understand your comment.

Touch one hardware key for every interaction then, not 123456, the hell?

Just because a task is hard it should never absolve anything. Guy could just have quit if he didn't want the responsibility.

Setting '123456' as a password on any non-trivial system is not "the shortest route possible to maximize their productivity." It would be setting the password as "000000"

The "fun" part is that it was only caught because the bill for the lookups was higher than expected. Had the attackers done a lookup every now and then, nobody would have noticed.

Apparently no one cares, until it becomes a financial issue. IT professionels have pointed out that the system is deeply flawed for 15 - 20 years, at least, but every issue has been papered over with more IT, tweaks to software and websites. The fundamental issues have never been addressed.

The average Dane doesn't even care. They'll just complain that they need to scan their health card, rather than shouting their CPR number across the pharmacy. Thousands of people have access to the system every day, abuse happens daily, but no one seems to care, because there hasn't been an actual costs associated with that abuse.

There's also the weakness that the security relies ok this information being secret. Denmark make use the personal numbers for a form of authentication, but the numbers are readable to many people. In sweden, this data is public by design. Authentication happens using public/private key and other secure mechanisms.

My first thought was "maybe security compliance training should include mandatory screening of Spaceballs"

Which does remind me of my game theory class in college... the professor would show movie scenes that demonstrated the game model we would be studying that week. It was quite effective, and certainly helped keep me engaged.

Way off topic, they're getting the band back together next year, https://www.imdb.com/title/tt32659463/.

Fingers crossed this late sequel parody somehow duplicates the original's charm. It would be embarrassing for Disney if it's better written/received than their own attempt with the source material.

The Spaceballs piece about it: https://www.youtube.com/watch?v=a6iW-8xPw3k

I don’t normally upvote jokes on hn, but it’s saturday and I was about to say the same thing.

Props to you, good sir. You beat me by one hour.

Funnily enough, luggage calls back to those TSA locks.

the same price of a large pizza where I used to work as a delivery guy! Those pizzas were way expensive.

I bet you are not the only one!

> Having a unique number that is needed for identifying individuals, but also often used for authentication and thus meant to be kept secret, is bound to go wrong

That's also not how they are used. They're maybe the username, but never the password, and absolutely not supposed to be secret. They are supposed to be extremely public.

Why would you think active directory has anything to do with this? That seems like a super random conclusion.

What happened is they found the password and email for an employee in a dump online - possibly for a different service, we don't know. If so, then the password was reused.

As a Dane I agree, but try constructing 13-19 in English. We just did it from 13-99.

However Im sad that now our national password is out :(

seks og halvtreds six plus two and a half times twenty

A least privilege access redesign seems reasonable too. And abuse monitoring; the leak went on for 21 days undetected.

Or simply make people who choose insecure passwords criminally responsible for the fallout.

What would that accountability look like?

I always find the use of acronyms a lack of education and manner. A way for the uneducated to try to sound sophisticated.

When I get an internal mail with multitude of acronyms I know that the people that wrote it does not care if anyone is going to read/understand it or not. It goes directly into the trash.

There are typically quite a few steps between initial access and domain domination, which I assume is what they ended up with, considering they have administrator account passwords. Well, unless you are using 123456 as the password for an admin account.

Yes and no.

The problem with the compromised platform is that it had no MFA. If they had just had something like OAuth via google workspace or something, this most likely could have been avoided. But it seems like they just had completely vanilla email/password auth with zero additional security measures.

There was a time when you would get a truly random password sent, every X months.

How about making the passords longer but easier to memorize? (no digit / letter / special character requirement)

https://xkcd.com/936

There are some unconfirmed rumors going that the maximum password length for the API was 8 characters...

1Password#

Oops, can I delete my comment, it was a copy paste mistake!

hunter2#

CPR is code for "registersamkøring". Register matching. The small wellfare nation needing to be able to see the populace as a sum of abilities and leanings and willingness to be swayed and pushed to support present and future economic needs of the whole.

For some unknown reason, the SSN in USA is assumed to be secret. You go to the bank, say SSN=12345 and they give you a million dollars and then send the collector the the guy/gal with that number, and call it identity thief instead of bad bank security or fraud.

Here in Argentina, the DNI is assumed to be public, it appears in a lot of public documents next to your name, and on election day there is a list of all the local voters with name and DNI at the door of the pooling site. To pay a sweater in two installments you may need to present the phisical DNI card and a water or electricity bill and they photocopy all of them.

It's unique, but it encodes your birthday and sex.

There's only 500 numbers it could be, assuming someone knows those other things about you.

In any case, there are alternative systems for authorisation.

I'm not super familiar with SSN in US of A, but I think the Danish one is not has secret. Don't get me wrong, the leak is not good, but there is a limit to what you can do with it.

Targeted and real looking spam mails come to mind. Hey <NAME> with <Address> and <CPR>, you have to log in <fake government website> to verify X Y Z.

Apparently some pay day loans or similar with just CPR + name is or was a thing. But lets hope that will change now. Bonkers as CPR should be be treaded as a secret.

yeah it's rather unfortunate isn't it

Nope.

Privatization

It was run by DXC Technology, the Danish branch of a US software house.

When doing a contract on such programs the Danish government must take the cheapest offer by rule

My password is 123qwe so it's safe for now.

Been there. Waited more than three years for a host to be properly accessible within a hospitals network. Project related.

Since then I think medical data science is mainly a waste of tax payer's money.

Completely real.