Someone used a private company's legal access to Denmark's Central Person Register (CPR), the national population register, to pull names, addresses and CPR numbers for about 8.8 million people. The Danish government disclosed the breach on 5 October 2026. Documents that broadcaster TV 2 obtained through a freedom-of-information request show that roughly 14 million automated searches ran between 10 and 20 September. Nobody noticed until 2 October, when a ministry employee saw an unusually large invoice. A person who says they carried out the attack told the Danish newspaper Politiken that the company account was protected by the password "123456". Danish authorities have not confirmed that claim. Most reporting puts the number of affected people at 8.8 million. TechCrunch's early coverage said "some 8 million." This is thought to be the largest data breach in Danish history.
What Happened
The CPR administration said the attacker got in "by abusing a Danish company's legal access to search for information in the CPR system." No vulnerability in the CPR platform itself has been reported. Private companies with a legitimate interest can query the register about defined groups of people they have identified in advance.
The timeline, pieced together from the sources:
- 10 September: The attacker first gets into the system, according to TV 2's documents.
- 10 to 20 September: About 14 million automated searches run (The Register, citing TV 2). CSIS Security Group says authorities described "well over 14 million attempted queries." The CPR office told the Danish Data Protection Agency that the unauthorised access appears to have stopped on 20 September. TV 2 also reports that the documents show the attacker had access for a total of 21 days and 17 hours. That fits with the company's access staying open until 2 October, even though the searching stopped earlier.
- 2 October (afternoon): The CPR administration spots irregular activity and closes the company's access. Mikkel Leihardt, a department head at the Ministry of Higher Education and Science, said at a press conference that the breach was found because a staff member noticed an unusually high invoice for the company's queries. The access monitoring had not caught it. Detection came 12 days after the last searches. TV 2 notes that authorities did not stop the attack; the attacker appears to have already finished.
- 3 to 4 October: Officials confirm the scale over the weekend. Police from the National Unit for Special Crime (NSK) visit the company on Saturday evening to secure evidence, according to department head Henriette Erbs. She said police are reaching out to international law enforcement because cases like this are often cross-border.
- 5 October: Digitalisation Minister Christina Egelund discloses the breach, calls it "an extremely serious incident," informs Parliament's Business and Digitalisation Committee and orders a full security review. The case is reported to the Data Protection Agency.
- 9 October: DR reports that a small software company on Funen is at the centre of the breach. Pays ApS, an Odense-based data company, confirms its CPR access was misused. The Register reports that managing director Sophie Laursen gave that confirmation. Pays' website has since been taken offline.
- Friday 9 October: The ministry sends a letter tightening security rules to 1,039 companies with CPR access (TV 2, via Ritzau).
Reports differ on who was behind it. TV 2's documents refer to a single "hacker," while official statements and CSIS refer to "unauthorised parties." Police have not named a suspect. The self-described attacker told Politiken they had no intention of selling or leaking the data. That claim cannot be verified and should not be relied on.
What Was Taken
Authorities say the exposed data includes names, addresses and CPR numbers for about 8.8 million registered people, plus "other information." The register holds about 11 million records in total, including deceased people and people who have emigrated. So roughly 80% of the register was affected. For comparison, TechCrunch puts Denmark's current population at about 6 million.
IBTimes UK reports that, according to authorities, the names and addresses of people registered with name-and-address protection were not included in the accessed data.
The data is highly sensitive. A CPR number is a permanent 10-digit identifier used across Danish public administration, banking, healthcare and taxation, and its first digits encode the holder's date of birth. Unlike a password, it cannot simply be changed. CSIS reports that the Danish Agency for Civil Protection said after the breach that CPR numbers can no longer be relied on to identify a person.
The Attack Technique
The confirmed facts are:
- A legitimate company account with authorised CPR query rights was used.
- According to BleepingComputer, the Danish Data Protection Agency described some form of brute-force enumeration: generating candidate CPR numbers, finding valid ones, then pulling each record. The predictable structure of CPR numbers (date of birth plus a short sequence) makes this feasible.
- The queries were automated, and there were millions of them over about 10 days.
How the account was compromised is alleged, not confirmed:
- Politiken reported that the self-described attacker said they got the credentials through the private company. Politiken also reported that at least three company accounts, including an administrator account, used the password "123456."
- DR independently found that a password the company had used, "123456," had been exposed in an earlier data leak. DR said it could not confirm that this specific credential was the one abused, but noted that it matches the attacker's account.
- Danish authorities have not confirmed the password or the exact intrusion method. The government did not answer The Register's questions about it, and Pays did not respond either.
CSIS sums up the main point: the login was valid, the queries stayed within what private companies are allowed to see, and monitoring did not flag the activity.
Why It Matters
Third-party access is the weak point. The CPR system was not exploited. A small vendor's legitimate access was, and DR notes that this vendor marketed itself on "top-secure data protection." More than 1,000 other companies have similar access, so the risk is systemic.
Volume anomalies were missed. About 14 million queries from a small data firm went unnoticed for weeks and were only caught through billing. If an invoice catches abuse faster than your security tooling, the problem is your detection design.
Exposure is permanent. CPR numbers are lifelong identifiers. Expect years of targeted phishing, impersonation and identity fraud aimed at Danish residents, emigrants and the estates of deceased people. Egelund urged citizens to stay alert for unsolicited messages, and a dedicated cyber hotline has been set up.
There is a pattern. TechCrunch places this alongside the 2016 Turkish citizen database leak and repeated exposures from India's Aadhaar system. National ID registries are high-value targets, and bulk-query interfaces are where they get hit.
What Organizations Should Do
- Require phishing-resistant MFA on every third-party API and portal account, especially accounts that can query bulk personal data. Treat admin accounts with a password like "123456" as a contractual breach, not just bad practice.
- Set behaviour-based rate limits and alerting on query volume per tenant. Baseline each partner's normal usage and alert on deviations in real time. Watch for sequential or enumerative lookup patterns. Don't wait for the billing cycle.
- Audit your partners' security, not just their contracts. Following Denmark's lead, require a named security officer at each partner, ongoing access reviews, and the right to audit. Revoke dormant or over-provisioned integrations.
- Check vendor credentials against breach data. DR found the reported password in an existing leak. Run partner and service-account credentials against breached-password corpuses and enforce rotation.
- Stop using CPR numbers, or any static national ID, as proof of identity. Banks, telecoms and public services should require stronger verification (such as MitID or step-up checks) for any request where a caller's CPR number currently counts as verification.
- Prepare for social engineering targeting Danish customers and staff. Warn users that callers quoting correct CPR numbers and addresses are not thereby legitimate. Tune fraud detection for account takeover and new-account fraud involving Danish identities.
Sources: Hacker Claims Password '123456' Enabled Access to Denmark's Nationa... | Denmark population registry data breach affects 8.8 million people | '123456' password linked to Denmark data breach affecting 8.8M people | Hackers steal 8 million citizens' records from Danish government da... | CPR breach: misuse of trusted access CSIS Security Group | Afsløring: Fynsk virksomhed er centrum for massivt CPR-databrud In... | Nye detaljer om cpr-skandale – hacker var over alle bjerge - TV 2 | Politiet har sikret sig spor i virksomhed, hvor lækket skete - TV 2