Password '123456' blamed for breach of Denmark's national population register
Data linked to about 8.8 million CPR numbers was pulled through a small IT firm's legitimate access. Credit-fraud warnings have nearly quadrupled in a week.
At a glance
- An attacker abused the legitimate CPR access of Pays ApS, a small IT company in Odense, to retrieve data on about 8.8 million records.
- The hacker told Politiken that at least three company accounts, including an admin account, used the password '123456'.
- The records cover roughly 5.5 million living and 3.3 million deceased people; protected names and addresses were not exposed.
- The breach was found after an unusually large invoice revealed about 14 million automated searches in ten days.
One of the world's most guessable passwords may have opened the door to Denmark's national population register.
Denmark's CPR administration confirmed that someone gained unauthorised access to its systems by abusing a Danish company's legal right to search the register. The company was later identified as Pays ApS, a two-person IT and data services firm on the island of Funen that offered address checks and death notifications to business customers.
'123456'
A person claiming responsibility told the newspaper Politiken that at least three Pays accounts — one of them an administrator account — were protected by the password "123456". Malwarebytes reported that initial access involved credentials tied to a former employee. Pays confirmed its access had been misused but had not answered questions about the password claims at the time of reporting, and its website has been taken offline.
How big is it?
The attacker allegedly retrieved information linked to around 8.75 million CPR numbers — about 5.5 million living people and 3.3 million who have died. That is more than Denmark's population because the register also covers former residents. People with protected names and addresses were not affected.
Documents seen by broadcaster TV 2 show about 14 million automated searches between September 10 and 20. The intrusion came to light after an unusually large invoice for the searches. A cybersecurity professor described the security as an open door.
The fallout
Denmark's digital affairs minister, Christina Egelund, called it a very serious incident and ordered a review of CPR security. It is too early to say whether people will be issued new CPR numbers. The number of Danes who registered credit warnings jumped from about 250,000 to nearly 970,000 in a week, and the head of the Danish Agency for Civil Security asked companies to stop accepting a CPR number alone as proof of identity.
The lesson travels well beyond Denmark: the weakest link in a national database can be a small third-party supplier with a bad password.
Questions people are asking
What is Denmark's CPR register?
The Central Register of Persons holds identifying details for people living in or connected to Denmark, including names, addresses, birth dates and personal ID numbers. It contains about 11 million records, including people who have died or moved abroad.
What should Danes do now?
Authorities advise watching for phishing messages that use personal details, and many people have registered credit warnings in CPR. Officials have also told companies to stop accepting a CPR number alone as proof of identity.
How we verified this story
GlobeHourly wrote this report in its own words after checking the facts against 4 independent sources: official statements, wire agencies and established news outlets. Read our standards.
