Hacker Says '123456' Password Opened Denmark's CPR Register to 8.8 Million Records

An anonymous hacker who says they were behind the breach of Denmark's national population register claims the way in was protected by "123456", one of the most widely used weak passwords in the world.

The attacker told the Danish newspaper Politiken that the break-in was not difficult. By their account, they logged in on 11 September using a leaked password that had belonged to a former employee of a small company licensed to search the Central Person Register (CPR). They then ran two programs they had written to find records and copy them to storage outside the system.

The claims have not been independently confirmed. Politiken asked Emil Hørning, a security specialist at Defend Denmark, to examine a file of CPR numbers the hacker shared with the paper, and he judged it likely that the account was accurate.

The company with the keys

The access belonged to Pays ApS, an IT and data services company based in Odense. Pays sells address updates and what it calls CPR cleansing, which means checking customer lists against the register to catch house moves and deaths. The company confirmed to broadcaster TV 2 that its authorised search access had been abused, and its managing director has acknowledged that the attacker used it to extract the data, according to The Register.

TV 2 reported that an email address tied to the password had surfaced in an earlier, larger data leak, which fits the hacker's description of a recycled credential. Politiken has reported that at least three user profiles at the company used the same password, reportedly including an administrator account.

Private companies and associations are allowed to query the CPR register, usually to keep customer or member addresses up to date. That arrangement meant one small contractor's login was enough to reach records covering most of the country.

How it went unnoticed

The data was taken in September. The ministry says the misuse ran for about ten days, and the reported search activity stopped around 20 September. Nobody noticed until 2 October, when an unusually large invoice, reportedly for around 14 million lookups, drew attention to the account.

According to the Danish Data Protection Agency, the attackers used brute force to work through possible CPR numbers, keeping the valid ones and retrieving the details attached to each. Politiken puts the total at 8,749,975 records: about 5.5 million belonging to living people and 3.3 million to people who have died. Danes who have moved abroad are included as well.

The exposed information includes names, addresses and CPR numbers.

The minister concedes failure

Christina Egelund, Minister for Research, Education and Digitalisation, called it an "extremely serious incident" when the breach was made public and briefed parliament's digitalisation committee. In a written response reported on 8 October she went further, acknowledging that the system's security had not been good enough. She said the specific route the hacker used has been closed and that she has asked for a review of the register's security.

Pays' access has been blocked, extra safeguards have been added to the system and police are investigating. No one has been publicly identified.

The hacker says they have no plans to sell or publish the records, and claims to have been genuinely shocked by how weak the protection was. They likened it to a case of plutonium left unattended at a railway station: the thief is to blame, they argued, but so is whoever walked away from it. There is no way to verify the promise not to sell, and it does not undo the exposure.

What it means for Danes

A CPR number on its own is not enough to log in to online banking or a digital ID, but paired with a name and address it gives fraudsters a convincing script. Authorities have told residents to treat unexpected calls, texts and emails with suspicion, even when the caller already knows their CPR number, and never to hand over passwords or one-time codes.

Many Danes have acted on that advice. Ministry figures reported by Ritzau show the number of people with a credit warning on their CPR record, a flag telling lenders to take extra care before granting credit, rose from just under 250,000 on 1 October to about 970,000 a week later.

• Records exposed: 8,749,975, covering living, deceased and emigrated people
• Entry point: a former employee's password at Pays ApS, reportedly "123456"
• Detected: 2 October, after an unusually large invoice
• Status: access revoked, police investigation under way, security review ordered

The larger question is structural. A register that underpins healthcare, tax, banking and elections was reachable through a third party apparently guarded by nothing more than a password, with no alert for millions of searches from a single account. Whether private firms should keep that kind of access, and on what terms, is likely to sit at the centre of the minister's review.

Earlier coverage: Denmark's CPR breach and what it means for digital trust