Denmark's CPR Registry Hacked With Password '123456'

What is the Denmark CPR registry hack?

In September 2026, an attacker breached Denmark's national CPR registry through an authorised third-party company and accessed the identity, address and CPR number data of roughly 8.8 million people. The entry point was a weak password: '123456'.

The Central Person Register (CPR) is Denmark's official population record, holding each resident's name, address, date of birth, citizenship and marital status. Every person is assigned a unique 10-digit CPR number used across healthcare, tax and banking.

According to CPR's statement, the attacker entered the system by abusing a Danish company's legal right to look up information in the CPR system. It is being treated as a supply chain attack: the attacker did not hit CPR directly but reached the data through a private company with authorised access.

The first press release did not name the attacker or the company involved. Danish media later identified the route as Funen-based Pays ApS, and the company's director, Sophie Laursen, confirmed it.

How did the attacker get into the CPR system?

The attacker logged in using the account of a former Pays ApS employee whose password was '123456'. They then wrote two scripts to pull CPR data into a third-party system and ran 14 million automated queries over 10 days.

Speaking to Politiken over an encrypted chat service, the attacker said they used a former employee's credentials and that the account's password was '123456'. Once inside, they wrote two scripts that pulled information from CPR and moved it to a third-party system.

Three separate accounts reportedly shared the same simple password. Local broadcaster TV 2 reported that the attacker ran 14 million automated lookups in ten days. The breach surfaced at the end of the month when a government employee noticed Pays's unusually heavy activity log for the previous month.

The attacker said they had no intention of leaking or selling the data and expressed surprise at how large the security gap was. Independent cybersecurity researcher Emil Hørning said the methods described appeared 'plausible' and the account 'credible'.

1. The attacker signed into Pays ApS using a former employee's account protected by '123456'.
2. They created two automated scripts that pulled CPR data.
3. They ran 14 million automated queries over 10 days.
4. The breach went undetected until an abnormal activity log was noticed.

Why is the CPR data breach so dangerous?

The stolen names, addresses, dates of birth and CPR numbers are used to verify identity for healthcare, tax and banking, so criminals can build highly targeted phishing and fraud from them. Even if the data is never sold, the risk of misuse stays high for years.

Because CPR numbers are the backbone of identity verification in Denmark, their exposure is a serious risk for individuals. Attackers can use the data for personalised phishing campaigns, ransomware delivery or bank fraud.

The attacker's claim that the data will not be sold or leaked is somewhat reassuring, but it is not a binding guarantee about how the data will be used. Experts warn that this kind of information can be abused years later.

The incident underlines how critical supply chain security has become. Third-party companies with access to high-security systems such as CPR need auditing at least as strict as the core system itself.

Why are weak passwords still the biggest corporate risk?

Weak passwords are the easiest target an attacker can find; predictable strings like '123456' can be cracked by automated tools in seconds. In corporate systems, one weak account can put the data of millions of people at risk.

In this case, three separate accounts sharing the same simple password shows how weak corporate password policies can be. Basic measures such as enforced strong passwords, multi-factor authentication and regular access reviews could have prevented the breach.

Cybersecurity specialists stress that organisations should invest not only in password strength but also in continuous monitoring of account access and real-time detection of abnormal activity.

Similar risks exist in Turkey. Weak password use in public and private sector systems can leave the door open to supply chain attacks. Regularly reviewing third-party access and applying the principle of least privilege is critical.

How can organisations and users prevent a similar data breach?

Organisations should tightly audit third-party access, enforce multi-factor authentication and monitor abnormal activity in real time. Individuals should use strong, unique passwords on every account and protect them with a password manager and two-step verification.

The Danish incident shows how destructive supply chain attacks can be. Organisations need to regularly audit every third party with access to critical systems such as CPR and apply the principle of least privilege.

There are lessons for individual users too: never reuse a password, avoid predictable strings like '123456' and turn on two-step verification wherever it is offered. These simple steps greatly reduce the damage in a data breach.

On technology forums, users are debating whether a similar breach could happen in Turkey and whether public institutions should review their password policies. Experts stress that password security is a corporate responsibility, not just an individual one.

1. Audit third-party access regularly.
2. Enforce multi-factor authentication.
3. Monitor abnormal activity in real time.
4. Train employees on strong password practice.
5. Apply the principle of least privilege.

Bottom line

The breach of Denmark's CPR registry with the password '123456' shows how devastating weak passwords and unmonitored third-party access can be. The identity data of 8.8 million people was exposed. Organisations should invest now in strong password policies, multi-factor authentication and real-time monitoring, while individuals should use strong, unique passwords on every account.