A Danish IT company’s use of the password 123456 enabled a breach exposing 8.8 million CPR numbers, with the hacker claiming no intent to sell the data, according to multiple reports.
The Danish Central Person Register (CPR) suffered a major data breach when a hacker accessed information linked to 8.8 million CPR numbers, including names, addresses, and registration details, using the password 123456 on a company’s account. The breach, which lasted 21 days and 17 hours, was discovered in early October 2026, with the affected company, Pays ApS, confirming its legitimate access to the CPR system had been abused.
The Weak Password and the Breach Timeline
At least three user accounts at Pays ApS, including an administrator account, were protected by 123456 when the breach occurred, according to reports from Cphpost and Computable. The hacker initially gained access via a leaked password from a former employee of a small Danish company, then developed programs to extract and store CPR data externally. The breach occurred between September 10 and October 2, 2026, with the CPR Office reporting the incident to the Danish Data Protection Agency on October 3.
Experts criticized the security measures. Jens Myrup Pedersen of Aarhus University, called the password protection “hopeless,” noting that 123456is among the first guesses in any attack. The hacker, who claimed no intention to sell the data, compared the breach tostealing a suitcase of plutonium left unattended at a train station, as reported by Swedenherald.
The Company and Its Role
The CPR register covers everyone registered as a resident in Denmark, including foreign nationals with a residence address here, and allows private companies and associations to access information when they have a legitimate need, such as to obtain address information about customers or members. The breach has sparked calls for stricter security reviews of organizations with CPR access, with the Ministry ordering an investigation into the incident.
Response to the Breach Investigation
The National Unit for Special Crime (NSK) is investigating the case, though no suspects have been identified as of October 9, 2026. The Danish Dream reported that the company’s access to the CPR register was stopped once the incident was detected. The CPR Administration had previously implemented fixed invoicing checks for abnormal usage patterns, but the breach highlights gaps in these safeguards.
The breach has also reignited debates about data privacy in Denmark. The CPR number being the key identifier used for a bank account, doctor’s appointments, tax records and public services on borger.dk is vulnerable to cyber threats. As the investigation continues, the focus remains on preventing future breaches and holding accountable those responsible for the lax security.