How did a trivial password at a Danish IT firm allow access to 8.8 million national ID records?
A trivial administrator password at a Danish IT firm allowed an attacker to access millions of national ID records via a legitimate portal.
Key points
- Pays ApS accounts used "123456" as an admin password, enabling unauthorized access to the CPR system.
- An attacker extracted data for roughly 8.8 million people, including the living and deceased, over 21 days.
- The breach highlights how weak credentials at third-party vendors can expose sensitive national databases.
The short version
- An IT company on Funen island, Pays ApS, had lawful search access to Denmark’s Central Person Register.
- At least three accounts at Pays, including an administrator, reportedly used the password “123456”.
- An attacker allegedly used these credentials to harvest personal records for nearly 8.8 million individuals.
The details
A weak administrator password is linked to a significant data exposure involving approximately 8.8 million Danish national identification numbers. According to Cyber Security News, at least three accounts at Pays, an IT company based on the island of Funen, used “123456”, including a high-privilege administrator account. This trivial credential choice reportedly allowed an attacker to bypass security controls and access sensitive data without breaking into the underlying register systems directly.
Politiken’s investigation revealed that the hacker shared stolen data with the newspaper, claiming the simple password unlocked access to CPR numbers and addresses. The outlet reported a precise count of 8,749,975 records, which explains why coverage varies between 8.7 million and roughly 8.8 million. The dataset included information on about 5.5 million living residents and 3.3 million deceased individuals who were previously registered in Denmark.
The Copenhagen Post reported that the attacker gained entry through a leaked password belonging to a former employee of the small Danish company. The hacker allegedly developed two programs to retrieve CPR information and exfiltrate it from the system. These operational details are attributed to the attacker’s own claims rather than an independent forensic report, though the volume of data confirms the scale of the intrusion.
The context
Access to the Central Person Register began on September 10 and continued for 21 days and 17 hours, according to reports. This extended window suggests that monitoring controls may have failed to detect repeated searches or unusual data collection patterns. Pays ApS, based in Odense, confirmed to TV 2 that its lawful search permissions had been abused. Managing director Sophie Laursen acknowledged the attack in an email, as reported by The Copenhagen Post.
Private companies and associations receive CPR access when they have a legitimate need, such as verifying customer or member addresses. This arrangement makes the security posture of each approved organisation critical, as valid credentials provide a direct route into sensitive public records. The incident resembles the Veradigm third-party data breach, where stolen vendor credentials allowed an attacker to download patient information through an approved interface.
Next steps
Organisations with third-party access to sensitive databases must review credential strength and monitoring capabilities immediately. The lengthy access window indicates a need for better anomaly detection in search logs. Vendors should ensure that administrative accounts use complex, unique passwords and that multi-factor authentication is enforced. Regular audits of third-party security practices can help prevent similar exposures in the future.
What to do and how to stay safe: Pays ApS
- Review all administrative accounts for weak or default passwords and enforce complex credential policies.
- Implement multi-factor authentication for all systems with access to sensitive personal or national data.
- Monitor system logs for unusual search patterns or bulk data extraction by third-party vendors.
- Conduct regular security assessments of organisations that have legitimate access to your databases.
Step-by-step guide: How Dark Web Monitoring Works: The Hidden Mechanics and Limits
General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many records were exposed in the Danish CPR breach?
Approximately 8.8 million records, including data on 5.5 million living and 3.3 million deceased individuals, were reportedly exposed.
How did the attacker gain access to the system?
The attacker used a leaked password, “123456”, belonging to an administrator account at Pays ApS, a company with lawful access to the CPR system.
How long did the attacker have access to the data?
Access reportedly began on September 10 and lasted for 21 days and 17 hours before the breach was detected or reported.
