Denmark Data Breach Involving 8.8 Million Records Linked to ‘123456’ Password
A weak password at Danish firm Pays ApS exposed about 8.8 million CPR records, including ID numbers and addresses.
Politiken reported that Pays ApS, a small IT company in Odense, had its authorized access to Denmark's Central Person Register abused after accounts, including an administrator, used the password 123456. An alleged attacker provided 8,749,975 records covering about 5.5 million living people and 3.3 million deceased people, including CPR numbers and addresses. The attacker said a former employee's leaked password enabled access starting September 10 for roughly three weeks, while authorities separately described about ten days of access. Pays confirmed the abuse; MitID was not reported compromised, and no fraudulent use of the records is confirmed.
- Pays ApS accounts, including an administrator, used the password 123456.
- About 8.75 million CPR records covered 5.5 million living and 3.3 million deceased people.
- Access abused authorized CPR permissions via a former employee's leaked password.
- MitID was not compromised, and no fraudulent use is confirmed.
Full article480 words · extracted from gbhackers.com · click to collapse
A significant data breach in Denmark has exposed approximately 8.8 million personal records, linked to inadequate account security at Pays ApS, a small IT company located in Odense, Funen.
An investigation by Politiken revealed that at least three accounts within the company, including an administrator account, utilized the password “123456.”
The compromised data included Danish Central Person Register (CPR) numbers and addresses. Politiken reported that the alleged attacker provided 8,749,975 records, which is why the coverage refers to the incident as involving either 8.7 million or approximately 8.8 million records.
This dataset reportedly includes information on around 5.5 million living individuals and 3.3 million deceased persons.
Denmark Data Breach
Pays ApS had legitimate authorization to access Denmark’s CPR system, which is the central civil registration database containing information about individuals currently living in or previously registered in Denmark. The incident involved misusing that authorized access rather than directly breaching the register’s underlying infrastructure.
According to the hacker, the intrusion began with a leaked password belonging to a former employee. The attacker allegedly accessed the CPR system through Pays and created two programs to retrieve personal information, then saved it outside the register.
Pays confirmed to Danish broadcaster TV 2 that its authorized access was abused, and the managing director and owner, Sophie Laursen, acknowledged the attack in an email, as reported by The Copenhagen Post.
The attacker claimed access began on September 10 and lasted 21 days and 17 hours. However, separate reports from authorities indicate about ten days of unauthorized access during September. These differing timelines should not be treated as interchangeable without further clarification.
This breach highlights how a compromised third-party account can expose sensitive information through otherwise legitimate access permissions.
The reported use of easily guessed passwords across multiple accounts raises serious concerns about credential controls, especially for accounts with administrator privileges.
While the exposed CPR numbers do not automatically grant attackers access to citizens’ digital identities due to Denmark’s MitID authentication system, criminals could combine these identification numbers and addresses with other leaked information to create detailed victim profiles or craft convincing phishing messages.
The hacker informed Politiken that there were no plans to sell or publish the stolen information. However, this statement remains an assertion, not a guarantee that unauthorized copies will remain private or will not be misused.
The National Institute of Standards and Technology (NIST) advises screening newly created or changed passwords against blocklists containing commonly used, expected, or compromised values. Blocking predictable credentials is especially relevant to the access mechanism reported in this incident.
Currently, no evidence suggests the exposed records were used for fraudulent activities or that MitID itself was compromised.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.