A major Danish privacy incident has been linked to remarkably weak account security at a company authorized to search the country’s Central Person Register. Reporting cited by Cyber Security News says information associated with approximately 8.8 million CPR identification numbers was obtained after access connected to the IT company Pays was abused.

At least three Pays accounts reportedly used the password “123456,” including an administrator account. The attacker is said to have used legitimate access available to the company rather than compromising the CPR register’s core infrastructure directly. That distinction does little to reduce the privacy impact, but it shows how a trusted partner can become the easiest route to sensitive public data.

Authorized access allegedly became a collection channel

Denmark’s CPR register contains personal details about current residents and people previously registered in the country. Private organizations and associations may receive search access when they have a legitimate purpose, such as confirming an address for a customer or member. Each approved account therefore extends the system’s security boundary beyond the government platform itself.

According to an investigation by Danish newspaper Politiken, the attacker provided the publication with stolen material and claimed that the predictable password helped unlock access to CPR numbers and addresses. Politiken counted 8,749,975 records. Reporting described the affected population as roughly 5.5 million living people and 3.3 million deceased people, figures that are rounded and should not be treated as a precise sum.

Separate reporting said the initial access involved a leaked password belonging to a former employee of a small Danish business. The attacker allegedly developed two programs to query CPR data and save it elsewhere. Those technical details come from the hacker’s account and have not been established through a public forensic report.

Access reportedly continued for more than three weeks

The unauthorized activity reportedly began on September 10 and continued for 21 days and 17 hours. Such a long collection window raises questions about monitoring at both the service provider and the organizations permitted to use it. Automated searches at unusual volume, rapid enumeration of unrelated people or sustained activity outside normal patterns should be candidates for real-time alerts.

Pays, an Odense-based company, confirmed that its lawful ability to search the register had been misused. The available accounts do not establish that criminals have used the copied information for fraud, and the attacker reportedly told Politiken that the data would not be sold or published. That assurance is impossible for affected people to verify and cannot undo the risk created by an unauthorized copy.

National identification numbers and addresses can support convincing impersonation, phishing or social-engineering attempts when combined with information from other sources. Organizations responding to the incident should avoid declaring downstream abuse without evidence, while still treating the exposed data as potentially useful to fraudsters.

Basic identity controls could have narrowed the risk

A password such as “123456” should be rejected automatically, especially on an administrative account with access to population data. Yet password quality is only one layer. Multifactor authentication could make a stolen secret less useful, while prompt offboarding would prevent former-employee credentials from remaining a route into production systems.

• Block common and breached passwords at enrollment and reset.
• Require phishing-resistant multifactor authentication for privileged users.
• Disable accounts immediately when staff or contractors leave.
• Limit each organization and user to the records required for their work.
• Alert on bulk lookups, automation patterns and unexpected export behavior.
• Review partner permissions regularly and revoke dormant access.

Session controls, device checks and rate limits can also reduce exposure when credentials are compromised. Logs should be retained in a form that supports investigation across the government service and partner environment. For especially sensitive queries, purpose-bound access and approval workflows can make unrestricted harvesting more difficult.

Third-party trust must remain conditional

The central lesson is that lawful access is not inherently safe access. A national register may be technically well protected while still being exposed through a smaller organization with weaker controls. Data owners need visibility into how partners authenticate, manage administrators, detect misuse and terminate access.

Security reviews should not end when a partner is first approved. Continuous oversight, narrow privileges and behavioral monitoring are necessary because personnel and systems change. The reported Danish breach shows how one weak link can turn a limited business need into population-scale exposure.