Denmark Confirms a CPR Register Breach Affecting 8.8 Million People; the “123456” Password Claim Is Unverified

Denmark’s population register was opened through a company’s legitimate login. The password that allegedly did it is the most common weak password on earth, and the government has not confirmed it. The CPR Administration said a serious incident occurred in September. Unauthorized parties used a private Danish firm’s authorized access to the Central Register of Persons and obtained names, addresses, CPR numbers, and other data on about 8.8 million registered people, living and dead. Politiken put the split at roughly 5.5 million living and 3.3 million deceased. Denmark’s population is about six million; the register is larger because it keeps records of people who have emigrated or died. People with special name-and-address protection were not exposed, the administration said. Pays ApS, an Odense IT and data firm, confirmed on October 9 that it was the company. Managing director Sophie Laursen told TV 2: “We can confirm that we are the company that has been subjected to an attack where our legal access to search for information in the CPR system has been abused.” The firm had about two employees listed as of July. Its website was taken down and later restored. What Is Confirmed and What Is Claimed The access path is confirmed: a private company’s lawful CPR credentials were misused. The volume is confirmed in outline: data on about 8.8 million people, and, according to documents TV 2 reported, about 14 million automated searches between September 10 and September 20. Access was shut on October 2 after an unusually large invoice for the searches drew attention. Activity appears to have stopped around September 20. The Danish Agency for Civil Protection said CPR numbers can no longer be relied on by themselves to identify a person. Police have not named a suspect. The password is not confirmed. A person claiming responsibility told Politiken, via an encrypted chat, that they used a former employee’s leaked credentials and that the password was “123456.” The same account said at least three company profiles, including an administrator account, used that password, that two scripts were written to pull data out, and that there is no plan to sell or publish the records. TV 2 reported that an email containing “123456” had appeared in a larger leak and that this matched its own research. Pays did not answer The Register’s questions about the claim. Danish authorities had not confirmed the password as the entry method as of mid-October. The detail that traveled farthest is the one the government has not endorsed. Why a Weak Password on a Trusted Account Is Enough Under Danish rules, private companies with a legitimate interest can query the CPR for specified data on people they have already identified. That access is a feature. It is also the attack path. A former employee’s account that was still active, if the claimant’s account is accurate, would have looked like normal use until the volume did not. Fourteen million searches in ten days is not a clerk looking up a customer. It is a script. The detection that caught it was a bill, not an alert that an admin account had run a population-scale query. “123456” is the top entry on common-password lists for a reason. It should be rejected by any modern policy, and a former employee’s account should be disabled on departure. If both failed, the rest of the controls — query limits, anomaly detection, multi-factor authentication on an admin login to a national register — did not stop 14 million lookups. The minister has said security around the CPR system was not good enough. That is the official judgment that does not depend on the password claim. The claimant’s promise not to sell or leak is a statement, not a control. Copied data that left the register is data the company and the state no longer solely hold. Where it sits, and who else has seen it, is not in the public record. What 8.8 Million CPR Records Are Worth A CPR number is Denmark’s personal identifier. Paired with a name and address it is enough to open accounts, file claims, and impersonate. The Agency for Civil Protection’s line that the number can no longer be relied on alone is the practical consequence: any process that treated a CPR number as proof of identity now has a weaker premise. Living and deceased records both matter. Deceased identities are used in fraud. Living ones are used in everything else. Pays ApS is a small vendor with authorized access to a national system. That is the structural fact. The register’s security was partly the security of every company allowed to query it. One of them, with a handful of staff, was the door. What to Watch Whether authorities confirm or refute the “123456” claim. Any arrest, or a statement that the claimant has been identified. How many of the 8.8 million records are confirmed copied versus queried. Remediation for people whose CPR numbers are now in unknown hands, including credit and identity monitoring. Changes to which private firms can query the CPR, and under what volume limits. Denmark has confirmed that a company’s lawful access to the national ID register was abused and that data on about 8.8 million people was obtained. The “123456” password is what the person claiming the breach told a newspaper. It has not been officially verified. The searches ran into the millions. The detection was a bill. The identifier Danes use for everything official is now one that the civil-protection agency says cannot stand alone. Digital8Hub will update if the password is confirmed or if charges are filed.