Weak Password "123456" Blamed for Breach of Denmark's CPR Register

Weak password blamed for Danish CPR breach

The password "123456" reportedly allowed a hacker to access Denmark's Central Person Register through Pays ApS, a small IT company based in Odense. The breach exposed information tied to approximately 8.8 million CPR numbers, covering a large share of Denmark's population.

At least 3 accounts at Pays ApS are linked to the breach. Denmark's Central Business Register listed Pays ApS as having just 2 employees as of July 2026.

Pays ApS confirms the attack

Managing director and owner Sophie Laursen confirmed to Danish broadcaster TV 2 that the company was subjected to an attack in which its legal access to search for information in the CPR system was abused.

An anonymous hacker told Politiken they were responsible and that gaining access was not particularly difficult. According to the hacker, the intrusion began with a leaked password belonging to a former employee of a small Danish company. The attacker allegedly used that access to reach the CPR system and created 2 computer programs to retrieve information and store it outside the register. The reported access lasted 21 days and 17 hours, beginning on September 10th. The hacker said there were no plans to sell or publish the information.

What the breach means for Danish citizens

Denmark's CPR is the central civil registration database. It holds information on approximately 11 million registered individuals, including current residents, people who have moved abroad, and deceased individuals. Multiple organizations can receive authorized access to certain register information when verifying customers' addresses or maintaining membership records, so the security of the register depends in part on the security practices of the organizations permitted to query it.

Although the breach affected nearly the entire population, attackers may not gain direct access to citizens' digital identities. Denmark relies heavily on MitID two factor authentication, so exposing a CPR number alone is not sufficient to impersonate someone. However, CPR numbers can be exploited in social engineering and phishing attacks to craft more convincing messages, and cybercriminals may cross reference the data with previous breaches to create more accurate profiles of potential victims.

Danish authorities have warned citizens to be cautious about unsolicited text messages, phone calls, and emails that contain personal information or appear to come from legitimate organizations. People should avoid sharing passwords, one time authentication codes, or other sensitive information in response to such requests.

Sources: Cybernews