Who else holds a login to your data?

· · Security

Count the outside organisations that can log in to your systems or your data. Your payroll bureau. Your accountant, through the bookkeeping software. The agency that built your website, the consultant who set up your CRM, the IT company with an admin account in Microsoft 365. Each of those logins was granted for a good reason, usually years ago, and each is a door into your business that you do not control.

Now count the ones you hold into your customers' systems. If you supply anyone larger than you, there are probably a few.

Denmark has just shown what one of those doors is worth.

What happened

Denmark's Central Person Register, the national database behind every Danish personal identification number, confirmed a serious breach on 5 October. Names, addresses, and identification numbers for around 8.8 million people were taken. Nobody broke into the register itself. The attacker used a Danish company's legitimate, paid-for access to look people up.

That company is Pays ApS, a small IT firm on Funen that offered address checks and record updates to its own business customers. Its managing director confirmed to Danish broadcaster TV 2 that its access had been abused. According to the Danish business register, it had two employees.

The details of how the attacker got in come largely from a person claiming responsibility, who spoke to the newspaper Politiken, so treat them as reported rather than proven. They say they started with a leaked password belonging to a former employee. Politiken then reported that at least three of the company's accounts, including its administrator account, used the password "123456". TV 2 says an email address with that password had already appeared in an earlier data leak, which matches the claim.

The timeline is the other half of the story. According to documents reported by The Register, the attacker got in on 10 September and ran about 14 million automated searches by 20 September. The access was stopped on 2 October. It was spotted because somebody in the ministry noticed an unusually large invoice for the company's lookups. Not an alert, not a monitoring system: a bill.

Why this is about your suppliers, not Denmark

It is easy to read this as a story about one careless company. That misses the useful part.

A two-person firm held a key to the records of almost everyone in the country, because the access was legitimate and the business purpose was real. The size of the supplier and the size of what it could reach had nothing to do with each other. That is normal. Your payroll bureau may be five people. Your website developer may be one.

Three things went wrong, and none of them is unusual:

  • An old login still worked. A former employee's password was reportedly still a way in. Accounts outlive the people they were made for unless somebody removes them.
  • The account had no second check. A password alone, and a guessable one, was enough. Two-step verification, the code from an app or text after you type your password, would have stopped a leaked password from being sufficient.
  • Nobody was watching what the account did. A firm with a small customer base running 14 million searches is not subtle. It was noticed through billing, after the event, as Malwarebytes points out.

Run those three against the outside logins into your own business and the question changes. It is no longer whether your suppliers are careful. It is whether you would know if they were not.

What to do this quarter

Make the list. Write down every outside organisation with a login to your systems or data: Microsoft 365 or Google Workspace, accounts and payroll, CRM, website, file storage, line-of-business software. Note who granted it and when. Most businesses have never done this, and the list is usually longer than expected.

Ask each supplier three questions. Is the account named to a person, or shared between several? Does it require two-step verification? When someone leaves your firm, how quickly does their access to our systems go? A good supplier answers in one email. A hesitant one has told you something useful.

Remove what nobody uses. The agency from the website rebuild three years ago does not need an admin account today. Turning off access is free and loses you nothing.

Look at what the accounts can see and do. Where your systems allow it, give outside accounts only the access the job needs, and switch on alerts for unusual activity such as large exports or sign-ins from new places. Your IT provider can tell you what your systems support.

Check your own logins into your customers' systems. If you are the supplier, you are the Pays in someone else's story. Make sure your team's accounts into client systems are named, protected by two-step verification, and removed when people leave. Expect to be asked about this in client security questionnaires, if you have not been already.

None of this is expensive. It is a list, a few emails, and some housekeeping that usually takes an afternoon.

How Steelwise can help

Working out which outside organisations can reach your data, and what each of them would need to do for that access to be safe, is a short and well-defined piece of security work. Get in touch if you want a second pair of eyes on your list.

Further reading

← All filings

We use cookies to understand how visitors use this site. More information.