Hacker Claims Password '123456' Enabled Access to Denmark's National Registry, Affecting 8.8M People

An anonymous individual claiming responsibility for the breach of Denmark's national population register told Danish newspaper Politiken that they had obtained login credentials through a private company. Separately, the outlet reported that at least three accounts at the company, including an administrator account, used the password '123456'.

Danish authorities confirmed that information linked to approximately 8.8 million registered people had been accessed. However, they have not publicly confirmed the reported password or established the precise method of intrusion.

How Denmark's CPR Breach Exposed Data Linked to 8.8M People

The Central Person Register (CPR), known in Danish as Det Centrale Personregister, is Denmark's national population register. It contains personal information, including names, addresses, and unique 10-digit CPR numbers used to identify individuals in public administration and other services.

In a press release, Denmark's CPR said someone had gained unauthorised access to its systems 'by abusing a Danish company's legal access to search for information in the CPR system.' The CPR explained that private companies with a legitimate interest can request information about 'a larger, limited group of persons whom the company has identified in advance individually'.

Danish authorities said the breach involved information associated with approximately 8.8 million people. The register contains around 11 million records, including information relating to deceased people and individuals who have moved abroad. The authorities said the unauthorised access did not include the names and addresses of people registered with name-and-address protection.

Danish media eventually traced the breach to Funen-based Pays ApS, whose managing director, Sophie Laursen, later confirmed that the company's CPR access had been misused.

An Invoice Raised the Alarm

The breach came to light after a CPR administration employee noticed an unusually high invoice linked to Pays. Documents obtained by local TV station TV 2 indicated approximately 14 million automated searches in ten days.

Politiken reported that it interviewed the alleged attacker via an encrypted messaging service. The anonymous individual claimed to have gained access using a former employee's credentials, reportedly protected by the password '123456'. They said they then created two scripts to retrieve CPR data and store it on an external system. However, the individual's account did not establish whether the former employee worked for Pays ApS.

'Really Shocked' by the Security

The person claiming responsibility for the breach told Politiken they had no plans to sell or publish the data and were 'really shocked' by the security weaknesses they allegedly encountered while accessing Denmark's CPR. They compared the situation to leaving dangerous material unsecured in a public place.

'Someone leaves a suitcase with 10 kilos of plutonium unattended at a train station. Then a homeless person steals it,' they said. 'Yes, of course you shouldn't steal other people's suitcases. But you also shouldn't leave nuclear material at a train station.'

The outlet reportedly obtained a file containing CPR numbers and consulted cybersecurity researcher Emil Hørning about its authenticity. Hørning said the individual's account 'appeared credible' and that the described methods were 'plausible.' His assessment does not independently establish every detail of the alleged intrusion. The incident raises questions about the security controls governing third-party access to sensitive government systems.