Breach · · 4 min read
A “123456” password let someone pull 8.8 million records from Denmark’s population register
An attacker abused a small data company’s legal access to Denmark’s CPR register. What happened, and what it says about the companies that resell our records.
On October 5, 2026, Denmark’s government said that someone had gained access to names, addresses and personal ID numbers for about 8.8 million people in the country’s Central Person Register, known as CPR. The attacker didn’t break into the register itself. They used the legitimate access of a small Danish company that was allowed to look people up, and, according to Danish media, that access was protected by the password 123456.
You may never have heard of the CPR, but the pattern is worth knowing wherever you live.
What happened
The CPR is Denmark’s national register of people, and a CPR number is a Dane’s personal identification number. More than 1,000 companies, including banks, phone companies, law firms, unions and insurers, have access to look people up in it, DR reports (in Danish). Denmark’s Ministry of Research, Education and Digitalisation said (in Danish) that an unauthorized party misused a private company’s lawful search access to obtain names, addresses, CPR numbers and other data on about 8.8 million registered people. That’s more than Denmark’s population, because the register also holds people who have died or moved abroad. The ministry said people registered with name and address protection were not included.
On October 9, Odense-based Pays ApS confirmed to the broadcaster TV 2 that it was the company whose access had been abused. Pays offered services such as updating customer addresses and checking whether people had died or moved, using CPR lookups.
According to documents TV 2 obtained, reported by The Register, the attacker got in on September 10 and ran about 14 million automated searches by September 20. The activity was noticed on October 2, after a ministry staffer spotted an unusually high invoice for Pays’ lookups. A person claiming responsibility told the newspaper Politiken that they got in with a leaked password, 123456, belonging to a former Pays employee, and said they had no plans to sell or leak the data. Politiken reported that at least three Pays accounts, including an administrator account, used that password. Those claims come from the attacker and press reports; the authorities haven’t confirmed them.
Denmark’s data protection authority, Datatilsynet, is investigating, and police are involved. The minister has ordered a security review of the CPR system, and on October 9 the CPR administration wrote to all 1,039 companies with access, reminding them that they need a named security lead, regular checks on which employees can look people up, and a watch on their monthly number of lookups.
Why it matters outside Denmark
This breach didn’t need a clever exploit. A national register gave lookup access to private companies, as many countries do in some form, and one of them didn’t protect it. Every company that is allowed to query or resell personal records is another door, and the door is only as strong as that company’s weakest password.
It also shows how long misuse can go unnoticed. Fourteen million searches from one small company’s account weren’t caught by monitoring. They were caught by a bill.
Canadians aren’t in the CPR, but the same idea applies to the data brokers and “people search” companies that collect and resell Canadians’ names, addresses and phone numbers. Each one holds a copy, and each copy can leak.
What you can do
If you live in Denmark, the ministry points people to sikkerdigital.dk for guidance. Its main warning is simple: never give out passwords or other confidential details over the phone or by email, even if the caller already knows your name, address and CPR number.
Wherever you live:
- Expect scams that use real details. A message that knows your address or ID number isn’t proof it’s legitimate. Our guide to how scammers use leaked data shows the common patterns.
- Cut down the copies. The fewer companies holding your details, the fewer places they can leak from. Our guide to opting out of data brokers in Canada walks through it.
- Don’t reuse passwords at work or at home. A password manager and passkeys remove the “old password from another leak” route this attacker reportedly used.
Sources
- Ministry of Research, Education and Digitalisation (Denmark), Omfattende uautoriseret adgang til borgeres CPR-oplysninger (in Danish), October 5, 2026
- DW, Denmark: Data of millions compromised in hack, October 5, 2026
- TV 2, Her er den fynske virksomhed cpr-lækket gik igennem (in Danish), October 9, 2026
- Politiken, Virksomhed: Det er os, der er blevet misbrugt til at hacke millioner af cpr-numre (in Danish), October 9, 2026
- Malwarebytes, How “123456” became the key to almost 9 million personal records, October 12, 2026
- The Register, ‘123456’ password linked to Denmark data breach affecting 8.8M people, October 13, 2026
- DR, 1039 virksomheder har fået indskærpet sikkerhed efter CPR-læk (in Danish), October 10, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.