The Denmark data breach linked to the password “123456” has exposed the personal records of about 8.8 million people, after a hacker claimed the trivial password opened the country’s national population database.
The breach hit Denmark’s Central Register of Persons, known as the CPR, which stores names, addresses and national ID numbers. Danish authorities confirmed the incident publicly on October 5, but they have not confirmed the hacker’s claim about the password used.
According to Danish newspaper Politiken, the attacker said at least three accounts at Pays ApS, a small IT company in Odense with authorised access to the register, used the password “123456”. One of those accounts reportedly held administrator privileges.
How the Denmark data breach unfolded
Pays ApS had legitimate access to the CPR system to validate business customers’ records. The attacker allegedly abused that trusted access rather than breaking through the register’s own defences.
Documents obtained by Danish broadcaster TV 2 show the intruder entered the system on September 10 and ran roughly 14 million automated searches between then and September 20. Nobody flagged the activity for weeks.
The breach surfaced on October 2, when a government employee noticed an invoice showing unusually high activity linked to the company. The Danish Data Protection Agency was notified on October 4, a day before the government disclosed the incident publicly.
Pays managing director Sophie Laursen confirmed on October 9 that the company’s access had been misused. The firm’s website has since gone offline, and police are investigating. The company’s access to the database has been blocked.
The person claiming responsibility told Politiken they had no plans to sell or release the stolen information. That assurance counts for little: Denmark’s Agency for Public Security, Samsik, now says a CPR number can no longer be trusted on its own to verify someone’s identity.
Why the CPR register matters so much
The CPR is the backbone of Danish civic life. Established in 1968, it assigns every person connected to Denmark a unique 10-digit number used for healthcare, banking, taxation, education and welfare services. Whoever holds a person’s CPR number, name and address holds the master key to that person’s digital identity.
The register contains about 11 million records, far more than Denmark’s living population of roughly six million, because it also covers deceased persons and citizens who moved abroad. The breach therefore exposed the dead and the diaspora as well as current residents, a permanent exposure no password reset can fix.
Records with protected names and addresses were not involved, according to the CPR administration’s statement.
The password lesson for readers in Pakistan
The “123456” detail is a warning that travels well beyond Denmark. The password has topped global lists of the most common and least secure passwords for years. Cybersecurity firm NordPass notes that simple numeric sequences from “12345” to “1234567890” remain the world’s most guessed credentials, and attackers try them first.
The episode also underlines a point Pakistan’s own authorities have been making: trusted insiders and weak credentials are often the real weak link. Pakistan recently barred government staff from using unapproved VPNs under new National CERT remote-access rules, and officials have repeatedly warned citizens against posting family photos and personal data online. Readers should also stay alert for hacking attempts targeting messaging accounts, since stolen identity data is most often weaponised through phishing.
If you still use “123456” or a close variant anywhere, change it now, switch on two-factor authentication, and use a password manager rather than memory.
What data was exposed in the Denmark data breach?
Names, addresses and CPR identity numbers belonging to about 8.8 million people, according to the Danish government’s October 5 statement.
Was the ‘123456’ password claim confirmed?
No. The claim comes from the person who says they carried out the attack, speaking to Politiken. Danish authorities have not confirmed which password was used.
How was the breach discovered?
A ministry staffer spotted an invoice showing unusually high activity from Pays ApS on October 2, nearly three weeks after the automated searches ended.
What should affected people do?
Danish authorities advise ignoring suspicious messages and never sharing passwords or one-time codes, since the stolen details could fuel convincing phishing attacks.
