Danish registry breach exposes 8.8M records via '123456' password

According to Danish newspaper Politiken, a hacker gained access to Denmark's Central Register of Persons by using the password '123456' on an account held by private firm Pays ApS, exposing personal details of 8.8 million people.

Three Pays ApS accounts shared the same password. The attacker used one of at least three accounts at the firm with the password '123456', one of which was an administrator account, according to Politiken. Access began on September 10, through what the hacker says was a leaked password from a former employee, and lasted 21 days and 17 hours in total, Danish media report.

The intruder ran roughly 14 million automated searches of the register between September 10 and September 20. Pays ApS, a two-employee company, had been granted access to the CPR to validate business customer records.

Breach discovered after unusually high invoice. Ministry staff noticed the anomaly on October 2 when reviewing billing records that showed far more searches than normal. The CPR administration had already confirmed the incident earlier in October.

Attacker claims no plans to sell or leak data. The person who took responsibility told Danish newspaper Politiken they were shocked by the poor security but had no intention of distributing the stolen information. The exposed records included names, addresses, and ID numbers for both living and deceased individuals.

Incident highlights persistent password risks. Multiple accounts at the same small firm used the same simple password despite handling access to sensitive government data. The case shows how basic credential hygiene failures can still enable large-scale exposure.