Millions of Danish Records Exposed in Breach Where the Password Was Reportedly Just ‘123456'

'Somewhere a hacker typed 123456 as a joke and then sat there in silence when it actually worked.'

That was one of the reactions online after reports emerged that at least three accounts at a small Danish IT company linked to a massive data breach used the password '123456' – including an administrator account.

Another commenter mocked the apparent security failure, writing: 'bro Denmarks whole national database ran on 123456, my sh*tpost folder has better opsec than that lmao'.

A third summed up the criticism: 'Opsec level: Using 123456 as a password for one of the most important national databases'.

The comments capture the disbelief surrounding a breach involving Denmark's Central Person Register (CPR), a national database containing personal information linked to approximately 8.8 million identity numbers.

But the reported security failure is more than an internet punchline. It raises serious questions about how a basic password weakness at a small private company could have consequences for millions of people.

A Password Anyone Could Guess – And Millions of Records at Stake

According to Danish newspaper Politiken, at least three user accounts at Pays ApS used the password '123456' when the company's authorised access to the CPR register was misused. One of those accounts reportedly belonged to an administrator.

Jens Myrup Pedersen, a professor at Aarhus University's Department of Electrical and Computer Engineering, described the company's password security as 'hopeless'.

'There is really no security, it is an open door. A password like '123456' is one of the very first things you would guess if you took a list of common passwords,' he told Politiken.

'I find it hard to see that you could have worse security. It was a matter of time before things went wrong.'

The reporting does not establish that the weak passwords alone were the precise technical route used by the attacker. An anonymous hacker who claimed responsibility told Politiken that access was initially obtained using a leaked password belonging to a former employee of a small Danish company.

The hacker allegedly created two computer programmes to retrieve information from the register and store it externally.

The Tiny Company at the Centre of a Huge Breach

Pays ApS, based in Odense, confirmed to Danish broadcaster TV 2 that its legitimate access to the CPR system had been abused.

'We can confirm that we are the company that has been subjected to an attack where our legal access to search for information in the CPR system has been abused,' managing director and owner Sophie Laursen said in an email to the broadcaster.

According to Denmark's Central Business Register, Pays had two employees as of July 2026.

The unauthorised access reportedly lasted 21 days and 17 hours, beginning on 10 September and ending on 2 October.

Authorities discovered irregular activity and suspended the company's access. The full circumstances of the incident remain under investigation.

The hacker claimed there were no plans to sell or publish the information. However, that assurance does not prove the data is safe, that no copies exist elsewhere or that the information cannot be misused.

What Was Exposed – And Why Millions Could Be Affected

Denmark's CPR system contains information associated with people who live or have previously lived in the country, including people who have died or moved abroad.

Danish authorities confirmed that the unauthorised access involved names, addresses and CPR numbers linked to around 8.8 million registered people.

The scale of the breach is alarming because criminals can use these details to make scam messages look frighteningly convincing.

Cybersecurity experts have warned that criminals could exploit personal information to create targeted phishing emails or messages that appear to come from legitimate organisations.

The government has also clarified that the unauthorised access did not include the names and addresses of people registered under name and address protection.

The reported figure does not mean that 8.8 million people have been confirmed victims of identity theft. However, the exposure of personal identifiers can create risks long after an incident has been discovered.

Denmark Faces a Test of Digital Trust

The breach has raised broader questions about the security of third-party companies permitted to access sensitive government information.

Businesses and clubs can check some CPR details, such as addresses, if they have a good reason to. That's handy for everyday services. But it also means a hack at one of those businesses could open the door to people's private information.

Denmark's Research, Education and Digitalisation Minister Christina Egelund described the incident as deeply serious.

'It is a deeply serious incident that I have therefore also briefed on the Danish Business and Digitization Committee. Together with all relevant authorities, we are in the process of mapping the full extent of the incident,' she said.

The government has initiated a security review of the CPR system and said measures are being taken to prevent similar incidents.

Questions remain over exactly how the breach happened, and whether tougher safeguards are needed. But one thing is already shockingly clear: a national database, guarded by cutting-edge technology, can still be left exposed by something as basic as a weak password.