The Password Was '123456.' The Breach Exposed Nearly Every Dane.

On October 5, 2026, Denmark's Ministry of Digital Affairs disclosed one of the most sweeping data breaches in the country's history. Unauthorized access to the Central Person Register, the CPR, had exposed information belonging to approximately 8.8 million people: their names, their addresses, and their CPR numbers, the 10-digit identifier that underpins taxes, healthcare, and banking for every resident of Denmark.

The register holds roughly 11 million records in total, including people who have died or emigrated. That means about 80 percent of the entire register was accessed. Around 5.5 million of those affected are living people, and about 3.3 million are deceased. In a country of roughly six million residents, nearly every Dane now has to assume their core identity data is in unknown hands.

What makes this breach unusual is not just its scale. It is how it happened. There was no zero-day exploit, no sophisticated intrusion into government infrastructure. The door was opened by a trusted key holder: a tiny IT company whose authorized access to the register became the attacker's tool.

The entry point: a two-employee firm in Odense

The CPR administration first described the breach as the abuse of a Danish company's legitimate register access, without naming the company. The company was Pays ApS, a micro IT firm based in Odense that, as of July 2026, employed two people. Pays had legitimate CPR access for services that included checking the records of business customers.

On October 9, managing director Sophie Laursen confirmed that someone had exploited that access. The company's website was subsequently taken offline, and the ministry cut off its register access. The CPR administration's billing system, which logs every search because companies pay per lookup, is what ultimately exposed the operation.

Fourteen million searches in ten days

According to documents obtained by TV 2, the attackers ran approximately 14 million automated searches between September 10 and September 20, 2026, roughly ten days of relentless querying. From a company with two employees, that volume was impossible to miss, at least once somebody looked.

Nobody was looking in real time. The anomaly surfaced on the evening of October 2, when the CPR administration noticed an abnormally large bill for the searches. Detection came twelve days after the search activity had stopped. Some reports suggest suspicious activity may have ceased around September 20, but the register kept counting, and the invoice did what the security monitoring had not.

The register counted every one of 14 million searches, because it charges for each. The invoice did what the security monitoring had not.

The '123456' claim, and why it is not confirmed

A person claiming responsibility for the breach told the Danish newspaper Politiken that the password '123456' opened access through a company account, and Politiken reported that at least three company accounts shared that password, including one with administrator privileges. In a separate claim reported by The Register, the same person said the first way in was a leaked password belonging to a former employee of a small Danish company.

It is important to be precise about what is known here. These details come from an anonymous person claiming responsibility and from reporting based on those claims. The Danish government has not confirmed that the password was '123456', and the exact technical chain of compromise has not been officially verified. The ministry has confirmed the scale and the timeline; the password story remains, for now, an attributed claim, not an established fact. That distinction matters, because the story's most shareable detail is also its least verified.

Why CPR numbers are so dangerous

The CPR number is not just another identifier. The 10-digit number follows a Dane through life: taxes, healthcare records, bank accounts, and most digital services are keyed to it. With names, addresses, and CPR numbers, fraudsters can make credible phishing and social-engineering attempts against essentially the entire population.

The ministry's guidance reflects exactly that threat. It warns residents never to hand over passwords or other confidential information over the phone, even if the caller already knows their name, address, and CPR number, and points people to the government's sikkerdigital.dk guidance for avoiding fraud. The ministry has said the breach excluded names and addresses covered by name-and-address protection, but that is a small exception against 8.8 million exposed records.

What happens next

Police are investigating, and the Danish data protection authority, Datatilsynet, is involved. The immediate operational response, cutting off Pays ApS's access, took place after the fact, as the searching had already stopped weeks earlier. The harder questions now concern the system design itself: why did no rate limit or anomaly alert fire when a two-employee company ran 14 million searches in ten days, and why did billing, a financial control, detect an intrusion that security monitoring did not?

That is the uncomfortable lesson of this breach. Authorized-access abuse is among the hardest attacks to catch, because the traffic is, technically, legitimate. Companies with lawful access to national registers operate inside the perimeter, where zero-day exploits are irrelevant and the only defenses are monitoring, rate limits, and least-privilege design. Denmark's register had excellent logging, every search was counted, which is more than many systems manage. But logs nobody reads are just archaeology. The invoice arrived after the attackers had finished.

Expect the fallout to reshape how third-party access to population registers works across Europe. For Denmark, the immediate task is fraud prevention at national scale: millions of residents who now must treat their CPR numbers as compromised. For everyone else, the lesson is simpler. Audit the access you grant, alert on the anomalies you can predict, and do not wait for the bill to tell you that you have been breached.