- Attackers reportedly accessed Denmark’s population registry through a third-party company using weak credentials
- Data on roughly 8.8 million individuals may have been exposed, including CPR identification numbers
- Breach highlights severe third-party security failures, with reports citing passwords like “123456”
Data held by the Danish national population registry was allegedly protected by a very strong, very difficult-to-crack password: 123456.
This claim was made by a person who allegedly broke into the registry in September 2026, accessing data on 8.8 million people.
Might as well been without a password
The Danish Central Register of Persons (CPR) is the country’s national population registry that maintains identifying information about people living in Denmark, including their names, addresses, birth dates, citizenship, and marital status.
Each individual is assigned a unique 10-digit CPR number which is widely used in healthcare, taxation, banking, and more.
In a press release, CPR disclosed that someone gained unauthorized access to its systems “by abusing a Danish company’s legal access to search for information in the CPR system.”
It explained that private companies with a legitimate interest can pull information from CPR about “a larger, limited group of persons whom the company has identified in advance individually.”
So, this was a supply chain attack, in which someone accessed names, addresses, CPR numbers, and other details, on roughly 8.8 million people, through a privately-owned third party. What’s also interesting is that the entire Danish population counts just over six million people, according to Worldometer - but CPR says it holds some 11 million records, including deceased individuals, as well as those living abroad.
The initial press release did not say who the attacker was, or which company was abused in the attack. It said the investigation was still ongoing and that CPR made moves to strengthen its security posture. However, Danish media uncovered that the attack happened through a Funen-based Pays ApS, a fact that was later confirmed by managing director Sophie Laursen.
Pays was authorized to access the CPR system, and the intrusion was spotted when, at the end of the month, a government employee saw an unusually high activity log from Pays for the previous month. Local TV station TV 2 said the attacker ran 14 million automated searches in ten days. In the meantime, Pays’ website was taken offline. At press time, it was operating normally, though.
"Really shocking"
The story gets better still. Local publication Politiken claims to have spoken to the attacker via an encrypted chat service. The threat actor, which wasn’t named, said they used login credentials of a former employee, whose password was “123456”. After logging in, they created two scripts to pull information out of CPR and into a third-party system.
Allegedly, three separate accounts were found all using the same simple password. The threat actor confirmed they have no intention of leaking, or selling the stolen data, and added they were “really shocked” by how poor the security posture was.
“Someone leaves a suitcase with 10 kilos of plutonium unattended at a train station. Then a homeless person steals it,” the hacker said. “Yes, of course you shouldn’t steal other people’s suitcases. But you also shouldn’t leave nuclear material at a train station.”
The threat actor gave the publication a file with CPR numbers, and the media confirmed its authenticity with the help of an independent cybersecurity researcher Emil Hørning. The researcher said the threat actor’s account “appeared credible” and that the methods he described were “plausible.”
While having no intention of selling or leaking the data is commendable, we can’t help but notice that the threat actor did not mention using the data. Names, addresses, birth dates, as well as CPR numbers used in healthcare, taxation, or banking - this is all very valuable information that can be put to use in highly tailored phishing attacks that can result in ransomware infections and wire fraud.
Via The Register