"123456" password linked to Danish CPR breach

A "123456" password on Pays accounts is linked to access to about 8.75 million Danish CPR records; sources disagree on duration.

Hackers abused lawful access held by Funen-based IT firm Pays ApS in Odense to Denmark's Central Person Register, Politiken, Ritzau and later outlets report. At least three Pays accounts, including an administrator, used the password "123456," with access said to have started from a former employee's leaked password; managing director Sophie Laursen confirmed the company's access was exploited. Politiken put the records at 8,749,975—about 5.5 million living people and 3.3 million deceased—including CPR numbers and addresses, a total other reports round to about 8.8 million. How long the access lasted is disputed: accounts cite 21 days or 21 days and 17 hours from 10 September, authorities are cited as describing about ten days, and TV 2 documents plus other reports say about 14 million automated searches ran until suspicious activity stopped on 20 September, with access shut off on 2 October after an unusually large bill. The alleged attacker told Politiken that two programs extracted and stored the data and that there were no plans to sell or publish it; fraudulent use is not confirmed, MitID was not reported compromised, and Datatilsynet was notified on 4 October.

• At least three Pays ApS accounts, including an administrator, used the password "123456"; entry is tied to a former employee's leaked password.
• Politiken reported 8,749,975 CPR records—about 5.5 million living people and 3.3 million deceased—including CPR numbers and addresses; other reports round this to about 8.8 million.
• Access reportedly began on 10 September. Duration is disputed: 21 days, 21 days and 17 hours, about ten days according to authorities, or searches through 20 September.
• About 14 million automated searches were reported; suspicious activity stopped on 20 September and access was cut on 2 October after an unusually large bill. Datatilsynet was notified on 4 October.
• Pays managing director Sophie Laursen confirmed the abuse. The alleged attacker said two programs extracted and stored the data and that it would not be sold or published; fraud use is not confirmed, and MitID was not reported compromised.