The Denmark CPR data breach allegedly began with a password that has spent years appearing on lists of passwords nobody should use: “123456.” Yet the incident is bigger than one spectacularly poor login choice. It has exposed broader questions about why more than 1,000 private organizations can access Denmark’s national population register and why prolonged, automated searches did not trigger an alarm.
Pays ApS, a Danish IT and data services company, had legitimate access to the Central Register of Persons, commonly known as CPR. Someone abused that access to retrieve information associated with roughly 8.8 million people, including names, addresses, personal identification numbers and other records.
The affected data reportedly covered about 5.5 million living people and 3.3 million deceased people. Denmark has a population of roughly six million, but CPR contains around 11 million records because it also includes people who have emigrated and those who have died.
How did the attacker get access?
The person claiming responsibility told Danish newspaper Politiken that a Pays account protected by “123456” provided entry. Politiken reported that at least three company accounts used the same password, including an administrator account.
Malwarebytes reported that the initial access may have involved leaked credentials linked to a former Pays employee. These claims have not been confirmed as official findings, and Pays had not answered The Register’s questions about the password allegation when its report appeared.
Pays provided services allowing customers to compare their information with CPR records. Those tools could be used to update addresses or identify people who had died. Pays managing director Sophie Laursen told Danish broadcaster TV 2 that the company’s lawful search access had been exploited.
The alleged attacker said there was no intention to sell or publish the extracted information. As of October 14, authorities had announced no arrest, identified no suspect and found no public evidence that the records had been sold or released. That is reassuring only in the narrowest possible sense. The location and control of the copied data remain unclear.
How long did the automated searches continue?
Documents obtained by TV 2 indicated that access began on September 10, followed by about 14 million automated searches through September 20. Digitalization Minister Christina Egelund initially described approximately ten days of abuse.
Other reporting gives a longer timeline. Danish news agency Ritzau said the unauthorized access lasted 21 days and 17 hours. Authorities have not publicly resolved that discrepancy.
The activity was discovered on October 2, after an invoice revealed unusually heavy usage. In other words, the billing system appears to have noticed before the security controls did. Egelund acknowledged that safeguards around the company’s access “have not been good enough” and said alarms should have activated during such prolonged abnormal activity.
The CPR administration terminated Pays’ access, informed Denmark’s Data Protection Agency and referred the case to police. The data protection regulator said its investigation remains open, including questions about what happened and which organization controlled the processing of the affected data.
Names and addresses belonging to people with special name and address protection were not exposed, according to the CPR administration.
Why can private companies search CPR records?
Danish law allows private organizations to query specified CPR information when they have a legitimate interest and have identified the relevant individuals in advance. That access is governed by Section 38 of the CPR Act.
Pays was therefore not an outsider breaking directly into a government database. It was an approved user whose credentials and permissions were allegedly misused. That distinction matters because trusted access can bypass some of the barriers designed to keep strangers out.
Following the breach, the CPR administration contacted all 1,039 companies with register access and reminded them to follow security requirements and appoint a security officer. The Danish Immigration Service also introduced additional identity checks for telephone inquiries.
Those measures address immediate risks, but they leave a less convenient question: why could one authorized connection conduct millions of unusual searches without effective rate limits or rapid intervention?
The national CPR system is operated by US IT provider DXC Technology under a contract lasting between six and eight years. No public finding has established wrongdoing by DXC, but the incident has put monitoring higher in the supply chain under scrutiny. A secure national register depends on more than asking each customer to choose a password that is not visible from orbit.
What are Danish officials investigating?
Members of Parliament have submitted questions about earlier security warnings, responsibility for the failure, possible foreign-state involvement and the current location of the extracted information. Those questions remained unanswered as of October 14.
Emergency Preparedness Minister Lisbeth Bech-Nielsen said Denmark is “in a hybrid war” and called political parties together to discuss possible responses. Authorities have not publicly attributed this incident to a foreign government, however, so the remark describes the wider threat environment rather than an established culprit.
The case follows a series of breaches in which attackers targeted organizations with privileged access rather than attacking major platforms head-on. An October compromise of Discord verification bot Double Counter, for example, exposed millions of users’ IP addresses. Researchers also reported in April that a hacker used artificial intelligence tools including ChatGPT and Claude while breaching Mexican government bodies and stealing citizen information.
For Denmark, the immediate investigation concerns Pays and the person who allegedly used its accounts. The larger issue is structural: every outside organization with legitimate access creates another place where weak credentials, abandoned accounts or poor monitoring can turn a trusted connection into a mass extraction tool. “123456” may have opened the door, but the system apparently allowed someone to keep carrying records through it.
