Attackers didn't break into Denmark's national population registry. They used a private company's legitimate access — and walked out with records on 8.8 million people. Four minutes. Let's go.
🚨 THE BIG STORY
Denmark's population registry breached through a vendor
The Central Population Register says threat actors misused a private Danish company's authorized access to extract names, addresses and CPR identification numbers on roughly 80% of everyone in the registry. The attack involved brute-forcing valid CPR numbers, then pulling the data attached to each. The company's access is now blocked and police are investigating.
🧠 Why It Matters
The registry's own security didn't fail — a vendor's did. Every third party with access to your systems is a door, and most businesses can't list theirs from memory. Denmark's warning to citizens is the one worth stealing: never give out confidential information on an incoming call, even if the caller knows your name, address and ID number.
⚡ CYBER IN 60 SECONDS
South Korea held an emergency meeting over bank breaches, with AI tools suspected. Shinhan Bank leaked 25,000 customer records and Kookmin 119,000 card details. Regulators ordered every bank to inspect all internet-facing systems — specifically including ones that aren't customer-facing, which is where the attackers appear to have gone. [South Korea Probes Bank Hacks, AI Tools Suspected]
The first cybercriminal ever on the FBI's Top 10 Most Wanted list is in custody. The alleged developer of Ploutus — malware that makes ATMs dump their entire cash supply — faces charges over $5.4 million stolen across 47 states, with proceeds routed to the Tren de Aragua gang. [FBI Most-Wanted ATM Malware Developer Arrested]
💼 THE BUSINESS OF SECURITY
Google paused its open-source bug bounty, flooded with AI-generated reports. Most submissions were invalid, and each still costs an engineer time to disprove. curl quit its program in January for the same reason; Intel dropped paid rewards last month. The side effect worth watching: fewer legitimate outlets for researchers, while offensive buyers have no triage problem. [Google Pauses Bug Bounty Over AI-Generated Spam]
🎭 SCAM TO WATCH
Microsoft's own X account — 13 million followers — was hijacked last week and used to promote a crypto token, with the promoters claiming it was tied directly to $MSFT stock. Microsoft says it has never authorized any cryptocurrency token. This keeps happening: Microsoft India's account in 2024, the SEC's account before that, which briefly moved Bitcoin's price with a fake announcement. The tell: a verified account is not a verified claim — verification shows who registered an account, not who's controlling it today. Never connect a crypto wallet to a site you reached through a social media link. That authorization is how the money leaves. [Microsoft's X Account Hijacked in Crypto Scam]
🛡️ TODAY'S SECURE MINDSET
Write down every outside company with access to your systems — accountant, IT provider, payroll service, CRM, anyone with a login to anything of yours. Most businesses have never made this list, which means nobody is reviewing whether that access is still needed. Today's lead story is what happens when one of those vendors gets compromised. Start the list today; cancel one you no longer use. [Denmark Registry Breach Hits 8.8 Million People]
See you tomorrow. — SecureMindset