Denmark Data Breach: Hacker Reportedly Used ‘123456’ Password to Access National Registry

A major data breach involving Denmark’s Central Register of Persons (CPR) has exposed information linked to approximately 8.8 million registered people, after a private company’s legitimate access to the national database was misused. Reports about the incident say an attacker allegedly obtained access through an account protected by the password “123456,” one of the simplest and most widely known weak passwords. Danish authorities have confirmed the unauthorised access, although the password detail has emerged through reporting about the alleged attacker’s account rather than an official government conclusion.

The incident has raised serious questions about password security, third-party access and the safeguards protecting government databases. The CPR contains personal information such as names, addresses and national identification numbers. According to reports, the attacker carried out millions of automated searches during September 2026 before the suspicious activity was detected in early October. Authorities have begun reviewing the system’s security, while the investigation into the breach continues.

Key Takeaways

• Scale of the breach: Unauthorised access affected information linked to approximately 8.8 million registered people in Denmark’s CPR database.
• Weak password allegation: Reports say an account at IT services company Pays ApS used the password “123456.”
• Third-party access: The incident involved misuse of a private company’s legitimate permission to query the national registry.
• Millions of searches: Reporting indicates that approximately 14 million automated queries were made during September.
• Detection delay: Authorities became aware of irregular activity on October 2, 2026, and publicly disclosed the incident on October 5.
• Investigation ongoing: Danish authorities have said the facts are still being established and have launched a security review.
• Important distinction: The government has confirmed the unauthorised access, but the alleged password used by the attacker has not been established as an official finding.

What Happened in Denmark’s National Registry Breach?

Denmark’s Central Register of Persons is a national database used to maintain information about people connected to the country. It contains approximately 11 million registered records, including current residents, people who have moved abroad and deceased individuals.

On October 2, 2026, the CPR administration became aware of irregular activity that had occurred during September. Over the following days, authorities established that unauthorised parties had used a private company’s legitimate access to retrieve information associated with approximately 8.8 million registered people.

The Danish government publicly disclosed the incident on October 5. It said the information accessed included names, addresses and CPR identification numbers. Authorities also announced preventive measures and a comprehensive security review to determine whether further changes were needed.

The reported scale makes the incident significant, but it is important to interpret the numbers correctly. The figure of 8.8 million refers to registered people whose information was accessed, not necessarily the number of people currently living in Denmark. The registry includes records for people who have died and people who have emigrated.

Authorities have not publicly established every detail of the attack. Their initial announcement said the circumstances were still being investigated and that the identity of the person or people responsible was not yet known.

How Was the ‘123456’ Password Allegedly Used?

The password allegation emerged through reporting by Danish media, including Politiken, which interviewed a person claiming responsibility for the breach. The individual reportedly said they gained access using a leaked password associated with a former employee of a private company authorised to query the registry.

Subsequent reporting identified the company as Pays ApS, a Danish IT and data services business. The company confirmed that its lawful access to the CPR system had been abused, according to reports from Danish broadcaster TV 2.

Politiken’s reporting indicated that at least three company accounts used the password “123456,” including an administrator account. The alleged attacker said this access enabled them to run programs that retrieved registry information and stored it outside the system.

These details remain important to distinguish from the government’s confirmed findings. Authorities have confirmed that the company’s legitimate access was misused, but their public announcement did not establish that “123456” was the password that enabled the intrusion. The precise method of access and the full sequence of events remain matters for the investigation.

If the reported account details are accurate, the case would illustrate how a basic security weakness at a third-party organisation can put a much larger system at risk. Even when a government database is not directly breached through a software vulnerability, the credentials of an organisation with authorised access can provide a route to sensitive information.

Why Was the Breach So Serious?

The CPR is a central source of identity information in Denmark. National identification numbers are used in interactions with public institutions and private organisations, making the data valuable for legitimate administration—and potentially attractive to criminals.

The combination of names, addresses and identification numbers can help attackers create convincing fraudulent communications. A scammer who knows details about a person may be able to make a phishing message appear to come from a government agency, bank, service provider or other trusted organisation.

Potential risks include:

• Targeted phishing: Criminals may use accurate personal details to make fraudulent emails, text messages or phone calls seem credible.
• Identity-related fraud: Exposed identifiers may be combined with information from other sources to support impersonation attempts.
• Social engineering: Attackers can use personal information to persuade people to reveal passwords, authentication codes or financial details.
• Long-term privacy risks: Information such as names and national identification numbers cannot simply be changed like a password.

However, the exposure of personal information does not automatically mean every affected person will experience fraud. The precise risks depend on which records and fields were retrieved, what the attacker retains and whether the data is subsequently distributed or misused.

Authorities have not publicly confirmed that the information has been sold or published. The alleged attacker reportedly said they had no intention of selling or leaking it, but such a claim should not be treated as a guarantee that the data will remain private.

How Did Authorities Discover the Suspicious Activity?

Reporting on the incident indicates that the attacker conducted approximately 14 million automated searches during September 2026. The activity reportedly ran between September 10 and September 20, although other reporting describes a longer period of access.

According to The Register’s account of documents obtained by Danish broadcaster TV 2, the unusual activity was identified after a government employee noticed an unusually large invoice associated with the company’s registry searches. Authorities became aware of irregular behaviour on October 2, around 12 days after the reported end of the automated search activity.

The episode raises questions about how access by external organisations is monitored. An account may have legitimate permission to retrieve certain information, but that permission does not mean every possible pattern of use is appropriate.

Security controls for sensitive databases should consider not only whether a user is authorised, but also how frequently the account accesses information, whether its behaviour changes suddenly and whether the volume of requests matches the organisation’s normal activities.

Automated queries can be useful for legitimate business purposes. But when a large number of searches occurs over a short period, monitoring systems should be capable of identifying unusual patterns and triggering timely reviews.

The available reporting does not establish exactly which controls were absent or why the suspicious activity was not stopped sooner. The government’s security review should help clarify what went wrong and which protections need to be strengthened.

The Role of Third-Party Companies in Data Security

The incident highlights the security risks associated with organisations that receive authorised access to government databases. Public institutions often rely on external companies for services such as customer verification, address validation and data processing.

Giving a business access can make these services more efficient, but it also creates another point where security can fail. A weakness at a small contractor can have consequences far beyond the company’s own systems when its accounts can query a large national database.

Organisations managing sensitive information need controls that extend beyond basic login credentials. These can include strong, unique passwords, multi-factor authentication where appropriate, restricted permissions, monitoring of unusual activity and regular reviews of accounts.

Access should also be limited to the information and functions a company genuinely needs. A compromised account with narrowly defined permissions can still cause harm, but limiting its capabilities may reduce the scale of an incident.

For government agencies, oversight of external access is equally important. Contracts and technical permissions should be supported by clear security requirements, regular audits and mechanisms that can quickly suspend access when suspicious behaviour is detected.

The Danish incident demonstrates why a trusted third party must be treated as part of the overall security boundary rather than as an independent risk outside the government’s responsibility.

What Should People Do After a Data Breach Like This?

People whose information may have been exposed should remain alert without assuming that they will necessarily become victims of fraud. The most practical response is to be cautious about unexpected communications and protect the accounts and services they use.

Useful precautions include:

• Treat unexpected messages carefully: Do not click suspicious links or open unexpected attachments, even if a message contains accurate personal details.
• Never share authentication codes: A legitimate support representative should not need a one-time code or password sent to you unexpectedly.
• Use unique passwords: Avoid reusing the same password across email, banking, shopping and other accounts.
• Enable multi-factor authentication: Where available, add an extra verification step to important accounts.
• Verify unusual requests independently: Contact a bank or government agency through its official website or published phone number rather than using contact details in a suspicious message.
• Monitor financial and account activity: Review alerts and statements, and report transactions or account changes that you do not recognise.

People in Denmark should follow any specific guidance issued by the relevant authorities. The available public information does not establish that every person connected to the registry needs to change every password or take the same action.

It is also important to remember that changing a password does not remove personal information that may already have been copied from a database. Password changes are useful when credentials are exposed, but preventing misuse of identity information requires broader vigilance.

How Denmark May Strengthen Its Cybersecurity

The Danish government has said preventive initiatives have been introduced and that a comprehensive security review of the CPR system is under way. The review is intended to establish whether additional safeguards are necessary.

Potential areas for improvement include stronger authentication requirements for third-party accounts, tighter access permissions, more effective monitoring of high-volume searches and faster responses to unusual activity. Authorities may also examine how external companies are approved, audited and removed from the system when their access is no longer required.

A critical question is whether the controls in place were designed to detect misuse by an account that appeared legitimate. Traditional security systems may verify that a valid account is being used without adequately evaluating whether the account’s behaviour is consistent with its authorised purpose.

A more resilient system combines identity verification with continuous monitoring and clear limits on what each account can retrieve. It should also be possible to suspend suspicious access quickly without waiting for an unusually large bill or another indirect warning.

The government has not yet published a final account of every failure or a complete list of resulting technical changes. Further findings from the investigation will be needed before responsibility and the effectiveness of any reforms can be fully assessed.

The Bigger Picture

The Denmark breach is a reminder that cybersecurity failures do not always begin with sophisticated software exploits. A weak password, exposed credential or poorly monitored third-party account can become a route into systems holding highly sensitive information. The reported use of “123456” is particularly striking because it highlights a basic security practice that organisations should already have addressed. Yet the password allegation must remain attributed to media reporting until investigators establish the precise method used.

The incident also shows why security cannot stop at the boundary of a government network. When outside companies are permitted to access national databases, their credentials, account permissions and activity become part of the public institution’s wider risk. Strong authentication, limited access, anomaly detection and clear accountability all matter. The eventual lessons from Denmark could inform how governments and private organisations manage external access to sensitive records.

What Happens Next?

The next stage is the investigation into how the registry was accessed, what information was retrieved and whether the exposed data has been retained, shared or misused. Danish authorities have launched a security review and said the circumstances are still being established. Further disclosures may clarify the role of the reported weak password, the effectiveness of monitoring systems and the changes needed to prevent similar incidents. Until those findings are available, claims about the exact entry method should be treated cautiously.

The wider cybersecurity industry will also be watching how Denmark strengthens oversight of third-party access to public databases. Organisations that handle sensitive information may need to reassess password policies, authentication controls, account permissions and automated-query monitoring. For individuals, the practical priority is to be alert to targeted scams and protect accounts with unique passwords and additional authentication. The incident is a warning that basic security failures can have consequences at national scale.

Frequently Asked Questions

1. How many people were affected by Denmark’s data breach?

Authorities said unauthorised access involved information linked to approximately 8.8 million registered people in Denmark’s Central Register of Persons. This includes people who have died or moved abroad, not just current residents.

2. Did the hacker really use the password “123456”?

Media reports quoting a person who claimed responsibility say the password was used on an account at Pays ApS. Danish authorities have confirmed the unauthorised access through a private company’s legitimate account, but their public announcement did not confirm the specific password allegation.

3. What information was exposed?

The Danish government said the accessed information included names, addresses and CPR identification numbers. The public announcement did not provide a complete record-by-record breakdown of the information retrieved.

4. What should people do after a data breach?

Be cautious about unexpected messages, never share passwords or authentication codes, use unique passwords and enable multi-factor authentication on important accounts. Follow official guidance and report suspicious account activity or attempted fraud promptly.