-
An alleged hacker claims the password “123456” opened a backdoor into Denmark’s Central Person Register through a private IT company.
-
The breach exposed names, addresses, and national ID numbers of about 8.8 million registered individuals.
-
Danish authorities confirmed the incident, but details about the password came from the alleged hacker’s own account to local media.
Denmark is dealing with one of its biggest security incidents ever. Its Central Person Register (CPR) was accessed without permission. Personal details tied to roughly 8.8 million registered individuals were exposed. An anonymous hacker claims a shockingly weak password made it all possible.
Danish authorities confirmed the breach on October 5, 2026. They described it as a serious exposure. The stolen records included names, home addresses, CPR identification numbers, and other personal details. The affected records cover current residents, people who have moved abroad, and even deceased individuals. That is why the number (8.8 million) goes beyond Denmark’s current population of about six million.
The alleged hacker’s story first appeared in Danish newspaper Politiken. The Copenhagen Post and other outlets later picked it up. However, investigators have not publicly confirmed every detail. The password claim comes from the hacker alone. It should be treated as one side of the story, not a fully verified fact.
How the hacker allegedly got in
According to reporting by The Copenhagen Post on October 9, the anonymous attacker says they broke in through Pays ApS. Pays ApS is a small Danish IT company. It had legitimate, approved access to the national register.
The hacker claims a former Pays ApS employee’s login credentials had appeared in an earlier data leak. The password on that account was “123456.” The attacker says they used those login details to enter the CPR system. They then built two computer programs. One pulled personal records. The other saved the data outside the system. The individual also told Politiken they handed over a file filled with CPR numbers as proof.
Later reporting on October 10 added more weight to the story. At least three Pays ApS accounts, including an administrator account, reportedly used that same weak password. Pays ApS later confirmed to Danish broadcaster TV 2 that its access to the CPR system had been misused.
Still, the full picture is not yet complete. The exact order of events and the hacker’s precise role are still under investigation.
Authorities step in as risks grow for millions
Danish officials say they first noticed suspicious activity in September. They became fully aware of the breach in October. Pays ApS’s access to the register was blocked. Police launched a formal investigation. Officials also rolled out extra security steps and urged the public to stay alert.
The Danish Immigration Service and the Danish Agency for International Recruitment and Integration both added extra identity checks for phone calls. Their users are among those potentially affected.
The exposed data carries real danger. Criminals can use names, addresses, and CPR numbers to craft convincing fake messages. They can pretend to be government bodies, banks, or service companies. The goal is to trick people into giving up passwords or verification codes. Because the data is real, the scam messages can look very believable.
Large-scale data exposure claims have also affected online services, including the alleged leak of 23.4 million SplitVPN user records.
DW and Euronews both reported on the scale of the incident, calling it extremely serious. Euronews noted that hackers accessed data belonging to 8.8 million people, underscoring the scale of the damage.
What the breach says about password safety
If the reported details are accurate, this incident shows a clear lesson. Giving an account with access to national records a password like “123456” is a serious risk. Companies should also shut down former employees’ accounts immediately after they leave.
Any company that holds sensitive data should enforce strong, unique passwords. Multi-factor login checks add another layer of safety. Access permissions should be limited. Systems should flag unusually large numbers of searches. Third-party access should be reviewed often and cut off when it is no longer needed.
For ordinary people affected by the breach, caution is the best tool right now. Unexpected calls, emails, or texts should be treated with suspicion. Criminals may already have your real details and use them to sound trustworthy. Always reach out to organizations through contact details you find yourself. Never share a password or a one-time code with someone who contacted you first.
The Danish CPR breach is confirmed. Pays ApS has acknowledged the misuse of its access. The “123456” password claim is attributed to the alleged hacker and supported by media reports, but investigators have not independently confirmed it as fact.
