A self-described hacker is claiming that one of the world’s most overused passwords — “123456” — was enough to unlock personal data belonging to 8.8 million people in Denmark’s national registry.
According to Danish newspaper Politiken, the individual said they gained entry through accounts at a small IT firm that held legitimate access to the country’s Central Person Register, better known as the CPR. At least three of those accounts, including an administrator login, allegedly used the same basic password. The hacker told the paper they had no plans to sell or dump the data online.
The company at the center of the incident is Pays ApS, a tiny Odense-based outfit that, under Danish rules, was authorized to query the CPR for business purposes such as verifying customer details. Its managing director later confirmed the firm’s access had been abused.
Once inside, the attacker reportedly ran automated scripts that fired off roughly 14 million searches over a 10-day stretch in September. Those queries returned names, addresses, CPR identification numbers and other personal information tied to about 5.5 million living people and 3.3 million deceased. Denmark’s living population sits around six million, but the full registry holds far more records because it also tracks people who have emigrated or died.
Access began around Sept. 10 and stretched more than three weeks. The whole thing only came to light on Oct. 2, when an unusually large invoice for the volume of lookups set off alarms at the CPR administration. The company’s access was cut immediately.
Danish authorities publicly confirmed the breach a few days later, calling it a serious incident. They said unauthorized parties had obtained the data by exploiting a private company’s legal access. People who had opted for name-and-address protection were not exposed in the same way. An investigation is underway involving police and the data protection agency. Officials have ordered a broader security review of the registry and the rules that let private firms tap into it.
The password claim itself has not been independently confirmed by investigators. It comes from the person who contacted Politiken and shared sample data to prove involvement. Still, the episode has put a harsh spotlight on how a single weak credential at a two-person company could open the door to an entire nation’s identity system.
For now, there’s no public evidence the full dataset has been leaked or sold. Danish officials are urging citizens to stay alert for phishing attempts that might try to weaponize the stolen information.
