Strong and Unique Passwords Really Matter? Denmark's Case

Thu, 15 Oct 2026 00:00:00 +0000

Why Every Password Needs to Be Unique and Complex (Denmark Just Proved It)

Last Friday I saw a headline that made me spit out my coffee. Records of 8.8 million people in Denmark’s national register were exposed, reportedly because a tiny company used the password 123456.

The company, Pays ApS in Odense, had just two employees and legal access to the CPR register, Denmark’s national ID system. The attacker reportedly used a former employee’s password from an older leak, and it worked on three accounts, including admin. Around 14 million searches later, someone noticed. Not because of security, but because of an unusually large bill.

I laughed. Then I felt uncomfortable, because the lesson isn’t “Denmark was careless”. That password was weak and it was reused, and most of us are guilty of at least one of those.

Two different mistakes

People mix these up, so let me separate them.

Complex means how hard a password is to guess. 123456 fails instantly. It’s one of the first things any attacker tries.

Unique means you use it on one account only. A password can be brilliant and still fail this test.

Denmark failed both. And you need to pass both, because each protects you from a different kind of attack.

Why complex matters

Guessing attacks are automated. Software tries the most common passwords first, then common patterns, then everything else, very fast. Short or predictable ones like 123456, password1 or yourname2026 fall almost immediately.

What helps most is length, not clever symbols. A long passphrase is harder to crack than a short one stuffed with symbols, and much easier to remember. Avoid famous quotes or anything a stranger could guess from your social media.

Why unique matters even more

Here is where most people stop. They make one strong password, feel safe, and use it everywhere.

Let’s say MyD0g$IsCute#2026!. Very strong. But you used it on ten sites, including some random wallpaper site you joined in 2011 that stores passwords badly. Some kid hacks it for fun. Now he has your strong password, and your bank too.

I learned this the hard way. In 2013, Adobe leaked 153 million accounts, and 1.9 million of them used 123456. I remember thinking: who does that? Then I checked myself and found I was using basically myname123 on Yahoo Messenger, Gmail, old forums and a throwaway email. A friend warned me to change my passwords. I changed one, the forum one, and left Gmail alone because it felt safe.

One week later I got a security alert: someone had tried to log into my Gmail from another city. I spent the whole night on recovery forms. Another friend, who works in IT, looked at the mess and said: one leak is all it takes.

That’s not just my story. In 2019, the Collection #1 to #5 dumps put billions of emails and passwords from hundreds of small breaches into circulation. Lists like that get fed into login pages on autopilot. Microsoft later said that when it scanned its own accounts in early 2019 against billions of leaked credentials, it found 44 million accounts using already-leaked passwords.

Denmark was the same story, just compressed. Nobody cracked anything. Someone took a password that had already leaked and typed it into a new door. In security this is called credential stuffing, and a script does it while the attacker sleeps.

Think of keys. You can have an expensive deadbolt on your front door. But if you copy that same key for your gym locker and your bike lock, your house is only as safe as the gym locker.

So what do I do now?

Reuse isn’t laziness. Most of us have dozens of accounts, and the brain takes the shortcut. So the answer can’t be “try harder to remember”. It has to be “stop remembering”.

A password manager. I use Bitwarden, which is free. Your browser’s built-in one is also fine, as long as it isn’t autofilling 123456. I remember exactly one password, a long sentence-style one: first-pc-was-beige-and-loud-as-a-jet. That old computer really did sound like it was taking off. Everything else is random, like xT9$kL..., generated and filled in for me. That gives me complex and unique without any effort.

2FA on what matters. Gmail, bank, Instagram. With 2FA, a leaked password alone is much harder to use, because the attacker needs a second factor too. An authenticator app is best, but even SMS is better than nothing.

Check yourself. Go to https://haveibeenpwned.com and enter your old email. Mine showed up in six breaches. If yours shows up too, don’t panic. Start with email, because it can reset everything else, then your bank, then anything with a saved card. The rest can wait a week.