Danish registry breached through accounts using weak password

Summarised from 2 outlets · Updated 14 Oct, 15:32 · Archive

An attacker accessed data on 8.8 million people held by Denmark's national population registry using weak passwords at a third-party IT company.

An attacker accessed Denmark's national population registry, the CPR, in September 2026, exposing data on 8.8 million people. The breach occurred through a supply chain attack: an attacker compromised accounts at a Danish company called Pays ApS that had legitimate access to search the CPR system for information.

Three accounts at the company were using weak passwords, according to reports. TechRadar states that one of these accounts used the password '123456'. The attacker accessed the system for ten days, according to TechRadar. The data exposed included names, addresses, CPR numbers (unique 10-digit national identifiers), birth dates, citizenship, and marital status.

The CPR confirmed the breach in a press release stating that someone had gained unauthorised access by abusing the Danish company's legal access. Managing director Sophie Laursen of Pays ApS later confirmed the company was the victim. The CPR said the investigation was ongoing and that it had taken steps to strengthen its security.

How it is being reported

• '123456' password was the only thing standing between hacker and data of 8.8 million peopleThree accounts were using the same weak password, allowing a threat actor to rummage through files for ten days.TechRadar · 14 Oct, 15:10
• '123456' password linked to Denmark data breach affecting 8.8M peopleLocal media reports three weakly protected accounts at small IT biz whose access to national register was abusedThe Register · 13 Oct, 12:14

In this story: Danish Central Register of Persons · Pays ApS · Denmark · Sophie Laursen

This summary was written by AI from the headlines and standfirsts above, and states as fact only what at least two outlets report. How we use AI · Report a problem