Password '123456' Exposed 8.8M Danish Records
In short: A hacker accessed Denmark's Central Person Register (CPR) through a contractor account at Pays ApS secured with the password "123456." Between September 10 and 20, 2026, roughly 14 million API queries pulled the names, addresses, and national ID numbers of 8.8 million people — living, deceased, and expatriated. The breach went unnoticed for 12 days until an unusually large invoice caught accounting's attention. It is a textbook case of how one weak password at a third-party vendor can undo the security of an entire national database.
What happened
Pays ApS is a contractor with legitimate access to Denmark's Central Person Register (CPR) to verify client data. At least three of the company's accounts, including an administrator account, were protected with "123456" — the most common and least secure password in the world. The attacker did not breach the register's core systems directly; instead, they used Pays's already-granted permissions to methodically harvest personal records. We regularly break down incidents like this in our privacy and security blog.
14 million queries in 10 days
According to the investigation, unauthorized access began on September 10, 2026. Over the following ten days, until September 20, roughly 14 million queries were sent to the registry's API. Reports indicate AI-generated code was used to automate the extraction, which let the attacker pull records at scale and speed — without the manual effort that might have made the attack easier to notice or throttle.
Why it took 12 days to notice
It wasn't a security monitoring system that caught the breach — it was accounting. Pays ApS staff flagged an unusually high invoice for API usage, which triggered the investigation. Danish authorities officially confirmed the incident on October 5, 2026. Nearly two weeks of anomalous activity — 14 million queries — went unflagged by the contractor's privileged-access monitoring. This is exactly the gap that data-protection regulators call the biggest supply-chain risk: an organization can harden its own perimeter and still be exposed through access it has granted to a partner.
What data was exposed
The leak included names, addresses, and national ID numbers of 8.8 million people — a figure that exceeds Denmark's current population because it includes deceased individuals and former residents who have since moved abroad. The person claiming responsibility for the attack says they don't intend to sell or publish the stolen data, but that claim can't be verified, and the sheer volume of exposed government ID records already raises the risk of targeted phishing, identity fraud, and attacks aimed at specific individuals.
What this means for everyday people
The "123456" story isn't an outlier — it's a systemic problem: many organizations grant contractors access to sensitive systems without requiring basic password hygiene or multi-factor authentication. If a database containing your name, address, and ID number leaks, you can't change that data — but you can limit what an attacker does with it next: never reuse passwords across services, turn on two-factor authentication wherever it's offered, and be skeptical of calls or emails that reference your exact personal details — a common sign of targeted phishing that follows breaches like this one.
How to reduce your risk
Basic password hygiene still matters: use a unique, long password for every service and a password manager that won't let "123456" slip through even by accident. For any account with access to sensitive data, two-factor authentication is non-negotiable — it would have stopped this attack even with a compromised password. A separate layer is network privacy: the LiMP VPN app encrypts traffic between your device and the internet and hides which services you use from your provider and network owner, and its no-logs policy means the service itself keeps no record of your activity. A VPN won't stop someone else's database from being breached — that's on the system owner and its contractors — but it closes your own data channel to interception and tracking.
Sources
Frequently asked questions
How exactly did the hacker get access to the registry?
Not directly — through an account belonging to IT contractor Pays ApS, which had legitimate query rights to the Central Person Register. At least three of the company's accounts, including an admin account, used the password "123456."
What exactly leaked and how many people are affected?
Names, addresses, and national ID numbers of 8.8 million people — living, deceased, and those who have since moved abroad. Authorities have not detailed the full field-level contents of each record.
Would two-factor authentication have stopped this attack?
Very likely, yes. 2FA requires a second factor to confirm login, so a compromised password like "123456" alone would not have granted account access without an additional code or device.