Denmark CPR Breach: “123456” Linked to 8.8M Records

The Denmark CPR breach reportedly exposed information associated with approximately 8.8 million personal identification numbers after attackers abused an IT company’s authorized access. Reports link the incident to weak account security, including the password “123456.”

Odense-based Pays ApS confirmed that someone had misused its legitimate access to Denmark’s civil registration system. However, details about the passwords and intrusion method come from reporting and an anonymous person claiming responsibility.

The incident raises questions about how organizations protect accounts that connect to large public databases.

Pays ApS Confirms Misuse of Its Register Access

Pays ApS acknowledged the attack on Friday, October 9. Managing director and owner Sophie Laursen said the intruder had abused the company’s permission to search the CPR system.

According to Denmark’s Central Business Register, the business had two employees as of July 2026.

Reports identified at least three accounts using “123456.” Such a predictable password offers little protection against an attacker trying common credentials.

Meanwhile, the person claiming responsibility described an initial entry point involving a leaked password belonging to a former employee. The available account does not clearly establish how that credential relates to the three profiles reportedly using “123456.”

That distinction matters: the company confirmed unauthorized use of its access, while the more detailed intrusion narrative remains an attacker’s account.

Attacker Claims Access Continued for Three Weeks

According to the anonymous account, unauthorized access began on September 10 and lasted 21 days and 17 hours.

The individual claimed to have written two programs that retrieved information from the register and stored it elsewhere. They also said they did not intend to sell or publish the data.

However, that assurance provides no independent guarantee about the information’s future use or availability.

The reported scale involves approximately 8.8 million CPR numbers. This does not necessarily represent 8.8 million current residents of Denmark.

The register contains around 11 million entries, including people who have moved abroad and individuals who have died. Consequently, the number of affected records should not be treated as a count of living residents.

Why Private Companies Can Query CPR Information

Denmark uses CPR numbers to identify individuals across public services and many private-sector transactions.

Authorized organizations can access certain register information for purposes such as checking customer addresses or maintaining membership records. As a result, even a small business may have legitimate reasons to query the system.

However, permission to retrieve information also creates a security dependency. Weak controls at an authorized organization can expose data held in a much larger public system.

The Denmark CPR breach therefore highlights risks surrounding third-party access, alongside the protection of the register itself.

Company size alone does not establish whether access was appropriate. The central questions concern the scope of that access and the safeguards protecting it.

Exposed Numbers Could Make Phishing More Convincing

A CPR number alone does not give someone control of another person’s MitID digital identity. Denmark’s authentication system provides additional checks beyond knowledge of the identification number.

Nevertheless, exposed personal information can support fraud attempts. Criminals could include accurate details in messages to make a false request appear legitimate.

They could also combine the information with material from earlier breaches to build more detailed profiles.

Danish authorities have therefore urged caution around unexpected calls, emails and text messages, even when the sender knows personal details.

People should not disclose passwords or one-time authentication codes in response to unsolicited requests. Familiar information in a message does not prove that the sender represents a trusted organization.