One of the simplest passwords imaginable is at the center of what may be one of Denmark’s largest data exposures. Reporting from Danish outlets indicates that administrator and user accounts at a small IT company with legitimate access to the national population register were secured with “123456,” allowing an attacker to quietly harvest personal records tied to roughly 8.8 million people over three weeks.

A Trusted Vendor’s Weak Link

The company at the center of the case, Pays ApS, is based in Odense on the Danish island of Funen. Like many businesses and associations with a legitimate need—such as verifying a customer’s or member’s address—Pays held authorized access to Denmark’s Central Person Register, known as CPR, the system that underpins identity verification across Danish public and private services. According to Danish newspaper Politiken, which reviewed data the hacker shared directly with its reporters, at least three accounts tied to the company, including an administrator account, used the password “123456.”

That is the part of the story that matters most: the attacker didn’t breach the CPR register’s own infrastructure. They went after the weaker perimeter of a company that had been granted trusted access to it, then rode that access straight into the national database.

Three Weeks of Undetected Access

Politiken’s investigation reports that unauthorized access began on September 10 and continued for 21 days and 17 hours before it was identified—a window long enough to raise serious questions about whether anyone was watching for unusual query volumes or bulk data pulls. The Copenhagen Post, citing the hacker’s own account, reported that the intrusion started with a password that had leaked from a former employee, and that the attacker went on to build two custom programs to pull CPR data out of the system and store it externally. Those details currently rest on the hacker’s own claims rather than a published forensic report, and should be read with that caveat.

Politiken puts the total at 8,749,975 individual records, which is why coverage of the incident alternates between describing it as roughly 8.7 million and roughly 8.8 million people. The exposed data reportedly spans about 5.5 million living residents and 3.3 million people who are deceased, covering anyone who is or has previously been registered as living in Denmark. Those figures are rounded estimates, not an audited final count.

Pays Confirms the Misuse

Pays ApS has acknowledged the incident. According to The Copenhagen Post, managing director and owner Sophie Laursen confirmed in writing to Danish broadcaster TV 2 that the company’s authorized CPR access had been abused. The admission at least settles one open question—that the access used was real and sanctioned, not a separate intrusion into the register itself.

The hacker reportedly told Politiken there were no plans to sell or publish the stolen data. That claim, even if true, does nothing to eliminate the underlying privacy risk: unauthorized copies of highly sensitive identity records, including national ID numbers and addresses, now exist outside any system Danish authorities control. Current reporting has not established that the data has been used for fraud, and that possibility should not be treated as confirmed either way.

A Familiar Pattern of Third-Party Risk

The structure of this breach—an attacker leveraging a trusted vendor’s weak credentials rather than attacking a target directly—echoes other recent incidents, including the Veradigm breach in the US healthcare sector, where stolen vendor credentials let an attacker pull patient data through an otherwise legitimate access channel. Cybersecurity researchers have separately found that “123456” and similarly weak passwords continue to top the list of credentials seen in automated RDP attacks, underscoring how predictable password choices remain one of the most exploited weaknesses in enterprise security, regardless of how sensitive the system behind them is.

What Organizations With Trusted Access Should Do

• Ban common and weak passwords outright, and require unique, complex credentials for any account with access to regulated personal data.
• Enforce multifactor authentication on every account that can query sensitive national or customer databases.
• Disable former employees’ accounts immediately upon departure, rather than relying on password changes alone.
• Limit access to only the records necessary for a given business purpose, and set alerts for unusual query volume or bulk exports.
• Treat partner and vendor access as an ongoing risk requiring periodic re-review, not a one-time approval that stands indefinitely.

For a register as consequential as Denmark’s CPR system, the incident is a reminder that the security of the weakest connected vendor can end up defining the security of the entire system.