'123456' password was all a hacker reportedly needed to expose over 8 million people's personal data

Please, please, please do not use '123456' as any kind of password. I know that may seem obvious, but apparently it bears repeating if a recent hack of Denmark's Central Register of Persons (CPR) is anything to go by.

To recap, the CPR administration said earlier this month that it had become aware of a breach that took place in September (PDF warning). This exposed personal details—names, addresses, ID numbers—of 8.8 million people, both living and deceased. It was confirmed at the time that the legitimate access of a private Danish firm had been exploited by the attacker.

A person claiming responsibility for the attack has come forward this week. Not only that, they say that they gained access to the CPR via an account which had the password '123456'. According to Danish newspaper Politiken, this was one of three accounts held by the private firm with that same password. One of these was an administrator account. …