SOC2Prep

The Danish national register breach involved the password 123456

October 13, 2026. From issue 10 of The Compliance Brief, one story for teams preparing for a first SOC 2 audit.

Last reviewed 2026-10-13Written by Jacob Masse, TrazTech Inc.

Issue 10 of The Compliance Brief was published on October 13, 2026. One of its 5 stories bears on the controls a SOC 2 audit tests, and they are below in short form. The full issue, with every take in full, is on traztech.ca.

Source: DataBreaches.net

Danish reporting says at least three accounts at the company connected to the CPR register breach used the password "123456", including an administrator account. The breach exposed names, addresses and CPR numbers for roughly 8.8 million people, living and deceased, after attackers used a legitimate company account to get in.

Our take, in short

No clever technique, no zero day, no framework gap. Someone had the control written down and did not enforce it on the accounts that mattered most.

Read the full take on traztech.ca

Also in issue 10

Outside the controls a SOC 2 audit tests, but in the same email:

Older: issue 9 All issues on SOC2Prep