Denmark's Biggest Data Breach Started With a Weak Password

The password was "123456" — at least, that is what the person claiming responsibility told the Danish newspaper Politiken. According to reporting by The Register, the intruder behind Denmark's biggest data breach slipped into the country's Central Person Register through an account at a tiny IT vendor whose administrator credentials were guarded by the most notorious password on the internet. The intrusion, confirmed by Danish authorities earlier this month, exposed the names, addresses and national ID numbers of nearly nine million people.

To understand the scale, you need to know what the register is. Det Centrale Personregister assigns every person with a connection to Denmark a unique ten-digit number, the CPR number, and that number follows a Dane everywhere: the doctor's office, the tax return, the bank account, university enrollment, a mobile phone contract. The database holds around eleven million records — more than the country's roughly six million living residents, because it also keeps files on the deceased and on citizens who moved abroad. The unauthorized searches touched about four-fifths of the entire archive, meaning the exposure reaches the dead and the diaspora as well as current residents.

The way in was not some sophisticated zero-day exploit. It was legitimate access, abused. Pays ApS, a small IT firm on the island of Funen with just two employees on the books as of this summer, held authorized access to the register so it could validate business customers' records. Someone used that doorway to run automated lookups at industrial scale. Managing director Sophie Laursen confirmed to Danish broadcaster TV 2 on October 9, 2026 that the company's access had been exploited, in comments reported by the Copenhagen Post and cited by Cybernews: "We can confirm that we are the company that has been subjected to an attack where our legal access to search for information in the CPR system has been abused."

A timeline of quiet failure

The intrusion began on September 10, 2026. Over the following ten days, the attacker ran roughly fourteen million automated searches against the register, according to documents obtained by TV 2. The activity stopped around September 20, 2026 — but nobody noticed for almost two more weeks. On October 2, 2026, a staffer in the ministry's accounting department picked up an invoice showing unusually high search activity from the vendor, and that bill is what finally triggered the alarm. Mikkel Leihardt, a department head at the ministry responsible for digitalization, told reporters at a press conference that the suspicious invoice led investigators straight to the compromised accounts.

What followed was fast: the vendor's access was cut off, the case was reported to the Danish Data Protection Agency on October 4, 2026, and the government publicly disclosed the breach on October 5, 2026. Pays confirmed its role on October 9, 2026. Then on October 13, 2026 came the detail that turned a national security story into a global punchline — the claim, relayed through Politiken, that at least three of the vendor's accounts, including one with administrator privileges, were protected by the same six-digit sequence. The government's official statements have not confirmed the password claim, and the company has not commented on it directly. Danish police are investigating.

Why this one cannot be fixed with a password reset

Here is what makes Denmark's biggest data breach different from the leak alerts you have learned to ignore. A CPR number encodes a person's exact date of birth and gender, and unlike a password, it cannot be changed. If your login credentials leak, you reset them and move on. If your national ID number leaks, you carry the exposure for life. Denmark's MitID login system adds a layer of protection against impersonation, but as Cybernews reports, a valid ID number makes phishing messages far more convincing — and the ministry has warned residents to ignore suspicious messages and not share passwords or one-time codes, pointing them to the official guidance site sikkerdigital.dk.

Security professionals are barely hiding their disbelief. "A password like 123456 should not be used by anyone, especially in sensitive systems that can access public infrastructure or public data. If this is true, it represents a serious oversight," Karolis Arbaciauskas, head of product at the password manager NordPass, told Cybernews. He added a detail that stings: Denmark's most common password is not even numeric — it is "admin," followed by "thunder" and "klovn123," with the infamous six-digit sequence sitting in fourth place. Simple numeric passwords have topped global worst-password lists for years, which is precisely why the claim is so damning: the first password any attacker tries was reportedly guarding the master key to Danish identity.

There are a few strange footnotes worth knowing. The person claiming responsibility told Politiken they had no intention of selling or leaking the data — small comfort, since the records cannot be un-seen. Analysts reviewing the attacker's extraction script found a bug that accidentally skipped people born in 1977, according to eSecurity Planet's review of the reporting, which means one birth year's records may have dodged the dragnet by pure luck. And the CPR administration says records under name-and-address protection were excluded from the accessed data.

The uncomfortable lesson is not really about one vendor's password habits. It is about architecture: a two-person company held a working key to the identity infrastructure of an entire country, and neither the vendor's own monitoring nor the government's cybersecurity systems flagged fourteen million automated queries. An accountant did. It was a rough week for digital trust all around — Microsoft's Patch Tuesday shattered its own fix record, and a spy-chip scandal hit crypto hardware wallets. For anyone who has ever reused a weak password because an account felt unimportant — this is the receipt for that logic. The account is rarely as small as you think, and the password is rarely as private as you hope.