In a 15 October 2026 Feature Articles piece, Remy Porter describes a breach of Denmark’s Central Register of Persons, known as CPR. Personal details belonging to 8.8 million people were exposed. The Register cited a cybersecurity specialist who argued that a state-issued ID number should never have been treated as a secret, although many systems still accept knowledge of that number as proof of identity.

Third-party companies can access CPR to send notifications to their customers. One account was protected with the password “123456”. A Politiken report cited by Porter said a Fyn company had at least three profiles using that password. The attacker entered the system on 10 September and spent ten days searching it. CPR detected the intrusion on 2 October while preparing an invoice, after finding far more searches than the company had customers. CPR allowed the weak password, and the third party chose to use it.

Porter also describes a supply-chain attack involving Ledger hardware wallets. These devices keep wallet keys locally and are designed to remain disconnected from the internet. Someone opened devices before sale, attached a microcontroller to the display leads, and added a cellular modem. The hardware could read a recovery code when it appeared on the screen and transmit it elsewhere. The thefts amounted to nearly $100 million in cryptocurrency.

The compromised devices had passed through Ledger for inspection. Tamper-resistant packaging was presumably used, but the exact point of tampering remains unknown. It may have occurred after Ledger’s inspection, with customers failing to examine the packaging, or earlier in the supply chain, where the inspection missed it.

Porter uses the incidents to question security models that place the final responsibility on end users. He also remains skeptical of blockchain projects. During consulting work for a large retailer, he heard a proposed supply-chain system justified by its ability to trace an E. coli outbreak. A regular database could have provided that traceability. In both cases, valuable systems depended on a basic secret or a user’s ability to spot hardware tampering.