Weak '123456' Password Exposed 8.8 Million Danish CPR Records

A massive data breach exposed personal data linked to 8.8 million Danish CPR numbers.

Anyone registered with a Danish CPR number could face risks of identity fraud.

The breach happened because an IT contractor used the weak password '123456'.

The breach occurred at Pays ApS, an IT firm based in Odense.

At least three company accounts used the simple password '123456'.

One compromised account was an administrator account.

Aarhus University professor Jens Myrup Pedersen called this password security hopeless.

The hacker had access to the CPR database for over 21 days.

Access began on September 10 and lasted nearly 22 days.

The hacker told Danish newspaper Politiken that gaining access was easy.

They used a leaked password belonging to a former employee of a small firm.

The hacker then used two custom programs to pull CPR data.

The hacker claimed they do not plan to sell or publish the records.

Private firms in Denmark can request CPR system access for legitimate business needs.

Official records show Pays ApS had only two employees in July 2026.

Managing director Sophie Laursen confirmed that attackers abused their valid system access.