Admin Password “123456” Led to 8.8 Million Danish CPR Data Breach

A weak administrator password is linked to a major Danish data breach that exposed information tied to about 8.8 million national identification numbers. At least three accounts at Pays, an IT company on the island of Funen, reportedly used “123456”, including an administrator account.

The case shows how poor security at a company with trusted access can place a national database at risk. Pays had permission to search Denmark’s Central Person Register, known as CPR. An attacker allegedly used that access to collect personal records rather than breaking directly into the register’s underlying systems.

Danish CPR Breach Unfolded

According to Politiken’s investigation, the hacker shared stolen data with the newspaper and claimed the password “123456” helped unlock access to CPR numbers and addresses. Politiken reported 8,749,975 records, explaining why coverage describes the breach as either 8.7 million or roughly 8.8 million.

The reported data covered about 5.5 million living people and 3.3 million deceased people. Those rounded figures should not be read as an exact total. The CPR register holds personal information about people living in Denmark or previously registered there.

The Copenhagen Post reported that the attacker gained access through a leaked password belonging to a former employee of a small Danish company. The hacker then allegedly built two programs to retrieve CPR information and save it outside the system. These details remain attributed to the hacker’s account, not a published forensic report.

Access reportedly began on September 10 and lasted 21 days and 17 hours. That lengthy window raises questions about whether monitoring controls could detect repeated searches or unusual data collection before millions of records were exposed.

Pays Confirms Misuse of Authorized Access

Pays ApS, based in Odense, confirmed to TV 2 that its lawful access to search the CPR system had been abused. Managing director and owner Sophie Laursen acknowledged the attack in an email, according to The Copenhagen Post.

Private companies and associations can receive CPR access when they have a legitimate need, such as checking customer or member addresses. This arrangement makes the security of each approved organization important, because valid credentials can provide a route into sensitive public records.

The pattern resembles the Veradigm third-party data breach, where stolen vendor credentials allowed an attacker to download patient information through an approved interface. The systems differ, but both cases show why trusted access needs close limits and oversight.

Cybersecurity News previously covered research into passwords used in RDP attacks, with “123456” leading the reported list. That research concerns remote desktop access, not Denmark’s CPR system, but highlights how predictable passwords remain useful to attackers.

Organizations handling identity data should block common passwords, require unique credentials and enable multifactor authentication. Former employee accounts should be disabled promptly.

Access should also be limited to necessary records, with alerts for unusual search volumes and bulk downloads. The breach also underlines the need to review partner access regularly, rather than treating approval as a permanent safeguard.

The hacker told Politiken there were no plans to sell or publish the information. That claim does not remove the privacy risk created by unauthorized copies of personal records.

The available reporting does not establish that exposed information has already been used for fraud, and it should not present such misuse as confirmed.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC