Probably not the best security in the world: Carlsberg wristbands spill visitor pics
(2026/01/16)
- Reference: 1768561208
- News link: https://www.theregister.co.uk/2026/01/16/carlsberg_experience_vulnerability/
- Source link:
Exclusive The Carlsberg exhibition in Copenhagen offers a bunch of fun activities, like blending your own beer, and the Danish brewer lets you relive those memories by making images available to download after the tour is over.
The images, however, are not stored securely. Researchers revealed that anyone could access the names and images belonging to the many hundreds of beer enthusiasts who visit the brewery each month.
One of those enthusiasts is Alan Monie, of Pen Test Partners, who, after visiting the experience himself, discovered that the codes used to access the images could easily be brute-forced.
[1]
In a [2]report shared with The Register ahead of publication, Monie said that exhibition patrons input their wristband ID into the company's website, and they are then taken to the images snapped of them that day, which can be downloaded.
[3]
The Carlsberg Experience wristbands (Pen Test Partners)
The format of these wristband IDs, which expire after 30 days, allowed for 26 million possible combinations, and Monie knew he could generate these easily using only a laptop.
Armed with what he called a "broad" vulnerability disclosure policy for the brewer, he got to work seeing how much data he could access.
[4]
[5]
Using Burp Suite, he deduced that the wristband IDs were converted into a hex string, which, when passed into Carlsberg's website, returned the corresponding visitor's images.
"Whilst sticking to the terms of the VDP, I was able to brute force 1 million wristband IDs in around two hours," said Monie. "It would be possible to gain access to all the valid wristband IDs in around 52 hours from one laptop.
[6]
"From the sample of 1 million, I validated around 500 wristband IDs, so multiplying that by 26 means that there are around 13,000 people who use the interactive elements at the Carlsberg exhibition every 30 days, assuming all the letters are used."
[7]
Downloading visitors' images taken at the Carlsberg Experience (Pen Test Partners)
The researcher said he was able to access the names, images, and videos of exhibition attendees, noting that this kind of information should be protected under [8]GDPR , although it is not the most salacious of leaks you'll see here at The Register .
Difficult disclosure
Monie's visit to Copenhagen took place in August. Days later, he submitted his vulnerability report to Carlsberg via Zerocopter on August 19.
[9]Pen testers accused of 'blackmail' after reporting Eurostar chatbot flaws
[10]Farmers Insurance harvests bad news: 1.1M customers snared in data breach
[11]Researchers remotely exploit devices used to manage safe aircraft landings and takeoffs
[12]Pen Test Partners: Boeing 747s receive critical software updates over 3.5" floppy disks
Despite Carlsberg promising to evaluate the report within ten working days, as well as providing regular progress updates, the company did not respond until November 11, according to the researcher's timeline of events.
This was the first and only time Monie heard from Carlsberg about the issue he reported nearly three months prior. In its response, Carlsberg said it addressed the matter by applying rate limitations, and asked Monie to retest.
He did just that, found that wristband IDs could still be brute-forced, and reported the same to Carlsberg, which to date has not responded to Monie. The company also did not respond to The Register's request for more information.
"In December, I asked Zerocopter again about the disclosure part of the disclosure policy, but they said that a client 'is in their rights to take their time' and that I should 'please be a bit more patient,'" Monie said.
[13]
"I think my patience has been exemplary, Zerocopter. The problem is that clients can easily avoid public disclosure by avoiding communication. That's not how to do responsible disclosure. That's not how to do IT security."
The issue remains exploitable, Monie told The Register , and as for the rate limiting, it "doesn't seem to have been applied effectively – either they didn't put it on the API, or just didn't implement it." ®
Get our [14]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aWpuvs7BH6GFd-7mXQYK_gAAANc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.pentestpartners.com/security-blog/carlsberg-probably-not-the-best-cybersecurity-in-the-world/
[3] https://regmedia.co.uk/2026/01/16/carlsberg1.jpg
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aWpuvs7BH6GFd-7mXQYK_gAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aWpuvs7BH6GFd-7mXQYK_gAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aWpuvs7BH6GFd-7mXQYK_gAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://regmedia.co.uk/2026/01/16/carlsberg4.png
[8] https://www.theregister.com/2025/11/11/eu_leaked_gdpr_ai_reforms/
[9] https://www.theregister.com/2025/12/24/pentesters_reported_eurostar_chatbot_flaws/
[10] https://www.theregister.com/2025/08/26/farmers_insurance_breach/
[11] https://www.theregister.com/2024/02/03/researchers_remotely_exploit_devices_used/
[12] https://www.theregister.com/2020/08/10/boeing_747_floppy_drive_updates_walkthrough/
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aWpuvs7BH6GFd-7mXQYK_gAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://whitepapers.theregister.com/
The images, however, are not stored securely. Researchers revealed that anyone could access the names and images belonging to the many hundreds of beer enthusiasts who visit the brewery each month.
One of those enthusiasts is Alan Monie, of Pen Test Partners, who, after visiting the experience himself, discovered that the codes used to access the images could easily be brute-forced.
[1]
In a [2]report shared with The Register ahead of publication, Monie said that exhibition patrons input their wristband ID into the company's website, and they are then taken to the images snapped of them that day, which can be downloaded.
[3]
The Carlsberg Experience wristbands (Pen Test Partners)
The format of these wristband IDs, which expire after 30 days, allowed for 26 million possible combinations, and Monie knew he could generate these easily using only a laptop.
Armed with what he called a "broad" vulnerability disclosure policy for the brewer, he got to work seeing how much data he could access.
[4]
[5]
Using Burp Suite, he deduced that the wristband IDs were converted into a hex string, which, when passed into Carlsberg's website, returned the corresponding visitor's images.
"Whilst sticking to the terms of the VDP, I was able to brute force 1 million wristband IDs in around two hours," said Monie. "It would be possible to gain access to all the valid wristband IDs in around 52 hours from one laptop.
[6]
"From the sample of 1 million, I validated around 500 wristband IDs, so multiplying that by 26 means that there are around 13,000 people who use the interactive elements at the Carlsberg exhibition every 30 days, assuming all the letters are used."
[7]
Downloading visitors' images taken at the Carlsberg Experience (Pen Test Partners)
The researcher said he was able to access the names, images, and videos of exhibition attendees, noting that this kind of information should be protected under [8]GDPR , although it is not the most salacious of leaks you'll see here at The Register .
Difficult disclosure
Monie's visit to Copenhagen took place in August. Days later, he submitted his vulnerability report to Carlsberg via Zerocopter on August 19.
[9]Pen testers accused of 'blackmail' after reporting Eurostar chatbot flaws
[10]Farmers Insurance harvests bad news: 1.1M customers snared in data breach
[11]Researchers remotely exploit devices used to manage safe aircraft landings and takeoffs
[12]Pen Test Partners: Boeing 747s receive critical software updates over 3.5" floppy disks
Despite Carlsberg promising to evaluate the report within ten working days, as well as providing regular progress updates, the company did not respond until November 11, according to the researcher's timeline of events.
This was the first and only time Monie heard from Carlsberg about the issue he reported nearly three months prior. In its response, Carlsberg said it addressed the matter by applying rate limitations, and asked Monie to retest.
He did just that, found that wristband IDs could still be brute-forced, and reported the same to Carlsberg, which to date has not responded to Monie. The company also did not respond to The Register's request for more information.
"In December, I asked Zerocopter again about the disclosure part of the disclosure policy, but they said that a client 'is in their rights to take their time' and that I should 'please be a bit more patient,'" Monie said.
[13]
"I think my patience has been exemplary, Zerocopter. The problem is that clients can easily avoid public disclosure by avoiding communication. That's not how to do responsible disclosure. That's not how to do IT security."
The issue remains exploitable, Monie told The Register , and as for the rate limiting, it "doesn't seem to have been applied effectively – either they didn't put it on the API, or just didn't implement it." ®
Get our [14]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aWpuvs7BH6GFd-7mXQYK_gAAANc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.pentestpartners.com/security-blog/carlsberg-probably-not-the-best-cybersecurity-in-the-world/
[3] https://regmedia.co.uk/2026/01/16/carlsberg1.jpg
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aWpuvs7BH6GFd-7mXQYK_gAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aWpuvs7BH6GFd-7mXQYK_gAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aWpuvs7BH6GFd-7mXQYK_gAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://regmedia.co.uk/2026/01/16/carlsberg4.png
[8] https://www.theregister.com/2025/11/11/eu_leaked_gdpr_ai_reforms/
[9] https://www.theregister.com/2025/12/24/pentesters_reported_eurostar_chatbot_flaws/
[10] https://www.theregister.com/2025/08/26/farmers_insurance_breach/
[11] https://www.theregister.com/2024/02/03/researchers_remotely_exploit_devices_used/
[12] https://www.theregister.com/2020/08/10/boeing_747_floppy_drive_updates_walkthrough/
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aWpuvs7BH6GFd-7mXQYK_gAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://whitepapers.theregister.com/
wolfetone
" In its response, Carlsberg said it addressed the matter by applying rate limitations, and asked Munro to retest. "
Hang on.
You've been told that the codes can be guessed essentially, and your solution to that is to just rate limit it?
I'm guessing the person in charge of this is either drunk or hasn't done this before.
Anonymous Coward
Wot? No organising piss ups in a brewery comments yet?
Fr. Ted Crilly
Hahaha, my first thought that, and here you are beating me to it...
"it is not the most salacious of leaks you'll see"
Jedit
I don't know, it runs the serious risk of blackmailers threatening to reveal that you drink Carlsberg.
Might not just be a Carlsberg problem....?
Anonymous Coward
Tourist attraction which take a photo and then show a QR code for downloading photos are becoming more common. They *could* be brute forced in a similar way if the QR code for those is also derived in a simple way.
Disclosure times
Having been on both sides of the disclosure coin, I can understand Carlsberg's point (that it takes time), but a 90 days (industry standard?) disclosure date _should_ be enough for something relatively straighforward.
What's not cool is the lack of response from Carlsberg. At the very least they should be acknowledging the mails sent and offering some sort of calming platitudes to make the slow response time slightly less bitter. Not replying, not being honest about the progress of a vulnerability is the quickest and easiest way to get zero-dayed. Oh look! Look what happened here!