Denmark CPR Breach: 8.8M Records Exposed via ‘123456’ Password

A single six-digit password — “123456” — unlocked the personal records of nearly every resident in Denmark after a hacker exploited a private company’s authorized access to the national identity database.

The breach compromised names, addresses, and civil registration numbers for 8.8 million living and deceased individuals stored in Denmark’s Central Register of Persons, known as the CPR system. The attacker gained entry through Pays ApS, a Danish firm contracted to validate business customer records against government databases, according to managing director Sophie Laursen’s October 9 confirmation.

At least three Pays ApS accounts, including one with administrator privileges, were secured with the same sequential numeric password, the hacker told the Danish newspaper Politiken. The intruder claimed no intention to sell or publicly release the stolen data, though the sheer volume of exposed information leaves millions vulnerable to identity fraud regardless of whether the dataset circulates on underground markets.

Danish civil registration numbers are far more sensitive than standard U.S. Social Security numbers. A CPR number encodes an individual’s exact date of birth and gender, and it functions as the universal key for banking, healthcare, tax filing, and digital government services across Denmark. Unlike passwords, citizens cannot change their CPR number if it is compromised, making the exposure particularly severe for long-term identity theft.

The scale of the intrusion became clear only after automated queries surged over a 10-day window. Between September 10 and September 20, the attacker executed 14 million searches against the CPR database using Pays ApS credentials, according to documents reviewed by Danish broadcaster TV2.

Neither the CPR administration nor Pays ApS detected the activity through internal security monitoring. Instead, a staffer at the Ministry of Research, Education and Digitalisation flagged the breach after reviewing a routine invoice that showed Pays ApS had generated an anomalous spike in search volume. The CPR administration formally acknowledged the September breach shortly after.

Pays ApS has since taken its website offline. The government agency responsible for the CPR system confirmed that a private firm’s legitimate access was weaponized but declined to name the company before Laursen’s public statement.

The persistence of “123456” in enterprise environments defies decades of cybersecurity warnings. Last year, approximately 7.6 million accounts globally relied on the string, more than double the usage of the second most common password, “12345678.” Sequential numeric strings starting with the number one occupied half of the top 20 most-used passwords worldwide.

Corporate reliance on trivial credentials has repeatedly opened doors to sensitive systems. In 2025, security researchers accessed a test administrator account on McDonald’s McHire recruitment platform by entering “123456” as both the username and password. Combined with a separate access-control flaw, the login allowed retrieval of job applicants’ personal data. Paradox.ai, the platform’s provider, patched the vulnerabilities after receiving the researchers’ disclosure.

European Union data protection authorities enforce strict notification timelines under the General Data Protection Regulation, requiring organizations to report serious breaches to supervisory authorities within 72 hours of discovery. Whether Danish regulators will pursue enforcement action against Pays ApS or the CPR administration for failing to detect 14 million unauthorized queries remains unresolved.

The CPR administration confirmed the full scope of the exposed data in early October.