Denmark Data Breach Involving 8.8 Million Records Linked to ‘123456’ Password

A significant data breach in Denmark has exposed approximately 8.8 million personal records, linked to inadequate account security at Pays ApS, a small IT company located in Odense, Funen.

An investigation by Politiken revealed that at least three accounts within the company, including an administrator account, utilized the password “123456.”

The compromised data included Danish Central Person Register (CPR) numbers and addresses. Politiken reported that the alleged attacker provided 8,749,975 records, which is why the coverage refers to the incident as involving either 8.7 million or approximately 8.8 million records.

This dataset reportedly includes information on around 5.5 million living individuals and 3.3 million deceased persons.

Denmark Data Breach

Pays ApS had legitimate authorization to access Denmark’s CPR system, which is the central civil registration database containing information about individuals currently living in or previously registered in Denmark. The incident involved misusing that authorized access rather than directly breaching the register’s underlying infrastructure.

According to the hacker, the intrusion began with a leaked password belonging to a former employee. The attacker allegedly accessed the CPR system through Pays and created two programs to retrieve personal information, then saved it outside the register.

Pays confirmed to Danish broadcaster TV 2 that its authorized access was abused, and the managing director and owner, Sophie Laursen, acknowledged the attack in an email, as reported by The Copenhagen Post.

The attacker claimed access began on September 10 and lasted 21 days and 17 hours. However, separate reports from authorities indicate about ten days of unauthorized access during September. These differing timelines should not be treated as interchangeable without further clarification.

This breach highlights how a compromised third-party account can expose sensitive information through otherwise legitimate access permissions.

The reported use of easily guessed passwords across multiple accounts raises serious concerns about credential controls, especially for accounts with administrator privileges.

While the exposed CPR numbers do not automatically grant attackers access to citizens’ digital identities due to Denmark’s MitID authentication system, criminals could combine these identification numbers and addresses with other leaked information to create detailed victim profiles or craft convincing phishing messages.

The hacker informed Politiken that there were no plans to sell or publish the stolen information. However, this statement remains an assertion, not a guarantee that unauthorized copies will remain private or will not be misused.

The National Institute of Standards and Technology (NIST) advises screening newly created or changed passwords against blocklists containing commonly used, expected, or compromised values. Blocking predictable credentials is especially relevant to the access mechanism reported in this incident.

Currently, no evidence suggests the exposed records were used for fraudulent activities or that MitID itself was compromised.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.