Denmark breach linked to “123456” password at Pays ApS

A password as basic as “123456” has been linked to the compromise of a Danish company with legitimate access to the country's Central Population Register (CPR), in a breach affecting information associated with about 8.8 million people. ¹

The Register reports that a person claiming responsibility told Danish outlet Politiken they used an account protected by the password. The newspaper said at least three accounts at Funen-based IT company Pays ApS used “123456”, including an administrator account. Pays managing director Sophie Laursen confirmed that the company's access had been exploited, although Pays has not responded to The Register's questions about the password claims. ¹

What happened to Denmark's CPR data

The incident was not a direct break-in to a secret government database. Pays had authorised access to the CPR system to provide services such as checking business customer records, and the breach involved the abuse of that legitimate access. The Danish government said information relating to 8.8 million people had been accessed; the wider register contains roughly 11 million records, including people who have died or moved abroad. ¹

The CPR administration said it noticed irregular activity on 2 October and disclosed the breach on 5 October. The Register's earlier report says the affected information included names, addresses, identification numbers and other personal data. It also says Pays' access was blocked while authorities investigated, with Denmark's data protection authority and police notified. ²

The Register reported that the attacker ran 14 million automated searches between 10 and 20 September, and that an invoice helped expose the unusual activity. The scale of the incident is therefore tied to both a weak credential claim and a system that permitted a large number of look-ups through a private company's legitimate access. ¹

Our opinion

The password allegation is the attention-grabbing detail, but it is not the whole security lesson. Stronger passwords would have removed one obvious failure point; they would not, by themselves, explain why a compromised third-party account could perform millions of sensitive searches before anyone spotted the pattern.

This is why access controls, rate limits, audit alerts and multi-factor authentication matter even when a service is operating within its legal business model. The Danish authorities' investigation should establish whether Pays breached its obligations, whether the access terms were too permissive and why the activity was not stopped sooner. Until those questions are answered, “123456” is best understood as a reported route into the incident, not a complete explanation of how the wider system failed.