Denmark CPR Breach Exposes 8.8 Million Records After Weak Password

Denmark's Central Person Register, known as the CPR, is the backbone of the country's digital society. Every registered person receives a 10-digit CPR number used for taxes, healthcare, banking and education. The register holds about 11 million records, including current residents, people who moved abroad and deceased individuals. Denmark's current population is about 6 million.

On October 5, 2026, the Danish Ministry of Research, Education and Digitalisation disclosed a CPR breach. The CPR administration learned on the evening of Friday, October 2, 2026, that there had been irregular activity in the system during September. Over the weekend it discovered the extent of the unauthorized access, and on Sunday, October 4, it notified the Danish Data Protection Agency, Datatilsynet.

Attackers obtained names, addresses and CPR numbers by misusing a private Danish company's legitimate access to search the CPR system. The breach affected about 8.8 million people, including living residents, deceased people and citizens who moved abroad. Because the CPR holds about 11 million records, the incident covers roughly 80 percent of the register. Minister Christina Egelund called it a deeply serious incident and said she had asked for a thorough security review of the CPR system.

The company is Pays ApS, a small IT vendor based in Odense. Denmark's Central Business Register listed Pays ApS as having just two employees as of July 2026. It offers data updates and CPR cleansing. Managing director and owner Sophie Laursen confirmed that Pays was the company whose legal access to the CPR system had been abused, and said it was cooperating with the ministry, police, the National Special Crime Unit and data protection authorities.

Key Facts

Malwarebytes reported on October 12, 2026 that an attacker used a leaked password to abuse a company's legitimate access to Denmark's population register. The CPR administration identified a serious security incident in which unauthorized people gained access to names, addresses, CPR numbers and other information on around 8.8 million people. The activity was discovered only after an unusually large bill drew attention to it.

Cybernews reported on October 12, 2026 that at least three accounts at Pays ApS are linked to the breach, and that the company's admins used the password 123456. TV 2 reported that an email containing the password 123456 had appeared in a larger data leak. Politiken found that at least three Pays accounts, including an administrator account, had used the same password. An anonymous hacker told Politiken they used a leaked password from a former employee and built two programs to retrieve the data, with no plans to sell or publish it.

NordiskPost reported on October 12, 2026 that newly disclosed documents show the unauthorized access began on September 10, but suspicious activity appears to have ended on September 20. The breach was not detected until October 2. The intruder's access technically remained open for 21 days and 17 hours. The documents, obtained by TV 2, were part of the incident report submitted by the CPR administration to Datatilsynet.

Help Net Security reported on October 6, 2026 that the CPR administration learned on the evening of Friday, October 2, 2026, about irregular activity during September. Over the weekend it discovered the extent, and on Sunday, October 4, it notified Datatilsynet. The ministry disclosed the incident on October 5. The review found that the unauthorized access does not include names and addresses of persons who registered with name and address protection.

TechCrunch reported on October 5, 2026 that the Danish government confirmed its central database of citizens' data was breached and most of its contents were stolen. The breach affects some 8 million citizens and residents, including people living abroad and the deceased. The CPR is used for taxes and other services. Denmark's current population is about 6 million, but the database includes records for about 11 million people, with some data going back decades. The breach is thought to be the biggest in the country's history.

Analysis

The timeline is as troubling as the scale. Access began on September 10, 2026. Suspicious activity stopped on September 20. Yet the breach was not detected until October 2, and access remained open for 21 days and 17 hours. Discovery came not from an automatic security alert but from an unusually large invoice generated by about 14 million searches through the private company's account. The company denied performing those searches itself.

What this really means is that safeguards around one of Denmark's most sensitive registers depended on after-the-fact billing rather than real-time anomaly detection. A vendor with just two employees had legitimate access to a system covering about 11 million records, protected by a password that had already appeared in a separate data leak. The password 123456 is the world's most common password, according to Cybernews, and should never guard public infrastructure. Karolis Arbaciauskas, head of product at NordPass, told Cybernews that a password like 123456 should not be used by anyone, especially in sensitive systems.

The bigger picture here is that national identity registers are only as strong as the weakest vendor with authorized access. The attackers did not defeat the CPR's core defenses. They walked through a legitimate door using a leaked credential. They stayed within the limits of the information private companies are allowed to retrieve, according to Help Net Security. That makes this a supply chain and access management failure, not a sophisticated zero day exploit. The searches looked lawful because they came from an account that was supposed to be making searches.

The data adds another layer of risk. Politiken reported that the stolen data belonged to approximately 5.5 million living and 3.3 million deceased people. Living individuals face potential phishing, social engineering and fraud, because CPR numbers are used across banking, healthcare and tax services. Deceased people cannot monitor their records, but their data can still be misused for identity fraud. Denmark relies heavily on MitID two-factor authentication, so a CPR number alone is not enough to impersonate someone. However, CPR numbers can be exploited in social engineering and phishing, and the ministry warned the data could be used in fraud attempts.

Why It Matters

The CPR is not just another database. It is the identity layer for Danish society. The 10-digit CPR number is used for taxes, healthcare, banking and countless everyday interactions. When names, addresses and CPR numbers for about 8.8 million people are exposed, consequences can ripple for years. The register holds records for about 11 million people, so the breach covers roughly 80 percent of it. The affected population is larger than Denmark's current population of about 6 million.

The breach is thought to be the biggest in Denmark's history, according to TechCrunch. It follows similar attacks on government national identity databases, including a 2016 breach affecting millions of Turkish citizens and several exposures of India's Aadhaar database. For a country that prides itself on digital government, the incident raises hard questions about how private companies are granted access to civil registration data, how they secure credentials and how authorities monitor unusual activity. About 14 million searches were needed to trigger attention, suggesting monitoring thresholds were too high or not designed to catch abuse of legitimate access.

The response has focused on containment and review. The company's access has been cut off, police are investigating and the ministry has not named a suspect. The CPR administration submitted an incident report to Datatilsynet. Minister Egelund said she asked for a thorough security review and that initiatives had been launched to prevent similar incidents. Those steps are necessary, but they also show how much needs clarifying: how the former employee's password remained useful, how many accounts shared the same weak credential and why suspicious activity was not flagged automatically. The breach may have ended on September 20, but its effects on trust and security policy will last much longer.

Next Up

Investigations continue on several fronts. Danish police and the National Special Crime Unit are looking into the breach. Pays ApS said it is cooperating with the ministry, police, the National Special Crime Unit and data protection authorities. Datatilsynet has been notified and is assessing the incident under data protection rules. The Ministry of Research, Education and Digitalisation is mapping the full extent and has asked for a thorough security review of the CPR system. The ministry warned citizens never to hand over passwords or confidential information.

Next steps will likely include changes to how private companies access the CPR, tighter authentication for vendor accounts and better real-time monitoring for unusual search volumes. The incident report submitted to Datatilsynet may reveal what safeguards failed. The hacker told Politiken there were no plans to sell or publish the data, but authorities cannot rely on that claim. For now, the breach stands as a stark reminder that a weak password and a small vendor can expose the personal data of millions. As the security review unfolds, the focus will be on whether Denmark can prevent a similar abuse of legitimate access in the future.