- A major Danish data breach reportedly exposed 8.75 mn records containing national identification numbers and addresses, including information relating to approximately 5.5 mn living and 3.3 mn deceased people.
- Hackers allegedly exploited the password “123456” at IT company Pays, which had authorized access to Denmark’s Central Person Register (CPR). At least three accounts reportedly used the password, including an administrator account.
- Unauthorized access reportedly continued for nearly 22 days, raising questions about identity data protection, third-party security controls and the monitoring of sensitive government databases.
A major cybersecurity breach in Denmark has reportedly exposed approximately 8.75 mn records from the country’s Central Person Register (CPR), with investigators linking the incident to weak passwords at a private IT company authorized to access the national database.
According to an investigation by Danish newspaper Politiken, at least three accounts belonging to Pays ApS, an IT company based in Odense, used the password “123456”, including an administrator account.
The attacker reportedly obtained access through compromised credentials rather than directly breaching the underlying government database.
The exposed information included Danish national identification numbers and residential addresses.
Politiken reported that 8,749,975 records were compromised, including data associated with approximately 5.5 mn living people and 3.3 mn deceased individuals.
These figures represent the reported scope of the exposed records rather than the number of currently living Danish residents affected.
Hackers exploited authorized access to Denmark’s CPR system
Pays had legitimate permission to search Denmark’s Central Person Register, which maintains personal information about current and former residents.
Private companies and associations can receive access to CPR records when they have an authorized business purpose, such as verifying customer information or updating addresses.
According to The Copenhagen Post, the attacker obtained a password associated with a former employee and allegedly developed two programs to retrieve and store personal records outside the system.
The attacker reportedly began accessing the database on September 10, maintaining unauthorized access for 21 days and 17 hours. These technical details are based on the hacker’s account and media reporting rather than publicly available forensic findings.
Pays confirmed that its legitimate access to the CPR system had been misused. Managing director and owner Sophie Laursen acknowledged the incident in correspondence reported by Danish media.
The extended period of unauthorized activity raises questions about whether the company’s security monitoring could identify unusually large numbers of searches or automated data extraction.
Denmark data breach raises third-party cybersecurity concerns
The incident illustrates the risks associated with granting private organizations access to sensitive government information. An attacker does not necessarily need to compromise a central database directly when credentials belonging to an authorized service provider can be exploited.
Similar concerns have emerged in other third-party security incidents, including the Veradigm healthcare data breach, where compromised vendor credentials reportedly enabled unauthorized access to patient information through an approved interface.
Predictable passwords remain a persistent cybersecurity weakness. Research into credentials used in remote desktop attacks has identified “123456” among the passwords frequently exploited by attackers.
Security measures for organizations handling sensitive identity information include blocking commonly used passwords, requiring multifactor authentication, disabling former employee accounts and restricting access to information necessary for legitimate operations.
Monitoring unusual query volumes and potential bulk downloads can also help identify suspicious activity involving otherwise valid credentials.
The attacker reportedly told Politiken that the compromised information would not be sold or publicly released. That statement has not been independently verified and does not eliminate the privacy risks associated with unauthorized copies of personal records.
There is currently no confirmed evidence in the available reporting that the exposed information has been used for identity fraud or other criminal activity.
The breach raises questions about password management, oversight of authorized third parties and the safeguards protecting Denmark’s national identity database.
