Reported by 11 outlets
Danish CPR data breach exposes records protected by weak '123456' password
Why this score
- Breadth
- 2.00 / 2.0 · 11 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 1.50 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.65 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 4.3 / 10 = base × recency + community
Desk analysis
Denmark's Central Register of Persons, the CPR, suffered a major data breach that exposed roughly 8.8 million personal records. A Politiken investigation traced the compromise to Pays ApS, a small IT company in Odense, where at least three accounts, including an administrator account, used the password 123456.
The person claiming responsibility for the breach says that trivially weak password was all it took to get in, and coverage from the Copenhagen Post, GBHackers, and Tom's Hardware repeats the 123456 detail. Danish authorities' own register data was reachable through a small vendor with default-grade credential hygiene, which is the whole failure in one sentence.
Breach scale makes this national news, but the durable lesson is vendor access control: a government-grade dataset was one guessable password away from public exposure through a contractor. Watch for Danish regulator findings on Pays ApS, any confirmation of how the data is being redistributed, and fallout for the CPR's data-sharing arrangements with small IT suppliers.
Timeline
-
original reporting
"123456" password used in massive Danish CPR data breach. Such stupidity. They should of course have used "654321". https:// cphpost.dk/2026
cphpost.dk · 3d ago · October 10th, 2026
"123456" password used in massive Danish CPR data breach. Such stupidity. They should of course have used "654321". https:// cphpost.dk/2026
via Mastodon https://cphpost.dk/2026-10-10/news/round-up/123456-password-used-in-massive-danish-cpr-data-breach/
-
update from securityonline.info
Denmark CPR data breach: attackers abused a firm's access, leaving CPR numbers exposed for 8.8 million people. Here is what to know and do.
securityonline.info · 8d ago · October 5th, 2026
Early coverage explaining that attackers abused a firm's legitimate access to the national register rather than exploiting a flaw in the register itself, leaving CPR numbers exposed for 8.8 million people. The piece includes practical guidance for residents on what the breach means and what to do.
-
update from cpr.dk
Omfattende uautoriseret adgang til borgeres CPR-oplysninger
cpr.dk · 8d ago · October 5th, 2026
The CPR administration's own advisory, published 5 October 2026, states that misuse of a Danish company's lawful search access to the CPR system gave unauthorized parties names, addresses, and CPR numbers for about 8.8 million registered citizens. It confirms the company's access was stopped, the incident was reported to the Datatilsynet, and police are investigating with other authorities. People registered with name and address protection were not covered by the unauthorized access.
-
update from cphpost.dk
CPR data breach exposes personal details of 8.8 million people in Denmark
cphpost.dk · 8d ago · October 5th, 2026
First Danish English-language coverage of the disclosure, reporting that the CPR data breach exposed personal details of 8.8 million people in Denmark. Published the same day authorities confirmed the incident.
-
update from gbhackers.com
Denmark Confirms Major Security Incident Exposing 8.8 Million Citizen Records
gbhackers.com · 8d ago · October 5th, 2026
Reports Denmark's confirmation of unauthorized access to the Central Person Register affecting about 8.8 million registered individuals, including names, residential addresses, and CPR numbers. Notes the impact figure exceeds Denmark's current population.
-
update from bleepingcomputer.com
Denmark population registry data breach affects 8.8 million people
bleepingcomputer.com · 8d ago · October 5th, 2026
Reports the CPR warning that roughly 8.8 million people, about 80 percent of the 11 million records in the register, had personal information exposed. Describes the attack as abuse of a private company's legitimate access rather than a compromise of the registry itself.
-
update from malware.news
Recent Danish PII Exposures Increase Risk of Targeted Phishing Campaigns
malware.news · 7d ago · October 6th, 2026
Assessment arguing the exposed CPR data raises the risk of targeted phishing, social engineering, impersonation, and identity fraud, and can validate or enrich information obtained from other sources. Notes authorities revoked the company's access, reported the incident to the Danish Data Protection Agency, and opened an investigation with law enforcement.
-
mentioned by cphpost.dk
`123456` password used in massive Danish CPR data breach https:// cphpost.dk/2026-10-10/news/rou nd-up/123456-password-used-in-massive-danis
cphpost.dk · 3d ago · October 10th, 2026
-
update from malware.news
`123456’ password used in massive Danish CPR data breach
malware.news · 3d ago · October 10th, 2026
Ritzau has more on the Denmark Central Person Register (CPR) breach: At least three accounts at the company linked to a major breach of Denmark’s CPR register reportedly used the password “123456”, including an administrator account. At least three user accounts at the Funen-based IT company Pays used the password “123456” when hackers gained access… Source Article Link: https://databreaches.net/2026/10/10/123456-password-used-in-massive-danish-cpr-data-breach/
-
mentioned by justpaste.in
Hackers steal 8 million citizens’ records from Danish government database The Danish government said the breach of names, addresses, and sta
justpaste.in · 3d ago · October 10th, 2026
-
mentioned by cphpost.dk
🤖 Denmark's CPR national registry: ~8.8M CPR numbers exposed. Pays ApS, the small Odense IT firm whose registry access was abused, had at le
cphpost.dk · 3d ago · October 10th, 2026
-
update from qz.com
https:// qz.com/denmark-national-regist ry-data-breach-8-million-100526?utm_source=flipboard&utm_medium=activitypub # DataBreach # CyberSecu
qz.com · 2d ago · October 11th, 2026
https:// qz.com/denmark-national-regist ry-data-breach-8-million-100526?utm_source=flipboard&utm_medium=activitypub # DataBreach # CyberSecu
via Mastodon https://qz.com/denmark-national-registry-data-breach-8-million-100526?utm_source=flipboard&utm_medium=activitypub
-
mentioned by en.killbait.com
Massive Danish CPR Data Breach Linked to Simple Password 📰 Original title: `123456' password used in massive Danish CPR data breach - The Co
en.killbait.com · 2d ago · October 11th, 2026
-
mentioned by en.killbait.com
https:// en.killbait.com/massive-danish -cpr-data-breach-linked-to-simple-password.html?utm_source=mastodon_social&utm_medium=social&utm_cam
en.killbait.com · 2d ago · October 11th, 2026
-
mentioned by dailytechnow.com
A massive Danish CPR data breach exposed 8.8 million records after hackers exploited accounts using the weak "123456" password. Read the ful
dailytechnow.com · 1d ago · October 12th, 2026
-
update from malware.news
How “123456” became the key to almost 9 million personal records
malware.news · 1d ago · October 12th, 2026
The weak password is remarkable, but the failure to spot millions of unusual searches made the breach worse. The CPR administration states it identified a serious security incident. How could a password so weak that it should have been rejected by the system open the door to so much personal information ? The attacker reportedly gained access through Pays ApS, an IT company based in Odense. Pays offers services including data updates and “CPR cleansing,” allowing customers to check records against the register to update addresses, identify people who have died, and obtain information about changes of address. The attacker reportedly used a leaked password associated with a former Pays employee. TV 2 says an email containing the password 123456 had appeared in a larger data leak, and that this account of the initial access matches its own research. The attackers had access for 21 days before it was shut down on October 2, although the suspicious activity appears to have sto
-
update from gbhackers.com
Denmark Data Breach Involving 8.8 Million Records Linked to ‘123456’ Password
gbhackers.com · 23h ago · October 13th, 2026
An investigation by Politiken revealed that at least three accounts within the company, including an administrator account, utilized the password “123456.” The compromised data included Danish […] The post Denmark Data Breach Involving 8.8 Million Records Linked to ‘123456’ Password appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from fed.brid.gy
Hacker claims ‘123456’ password let them breach the Danish national registry, accessing 8.8 million records https:// fed.brid.gy/r/https://w
fed.brid.gy · 15h ago · October 13th, 2026
Hacker claims ‘123456’ password let them breach the Danish national registry, accessing 8.8 million records https:// fed.brid.gy/r/https://w
via Mastodon https://fed.brid.gy/r/https://www.tomshardware.com/tech-industry/cyber-security/hacker-claims-123456-password-let-them-breach-the-danish-national-registry-accessing-8-8-million-records-it-and-data-services-company-with-weak-passwords-linked-source-of-the-hack