In Denmark, a large-scale leak of personal data of approximately 8.8 million people has occurred. Unknown parties gained access to the state population register through the private IT company Pays ApS. According to Danish journalists, at least three of the company's accounts, including an administrator account, used the password "123456".
HOW THE DATA LEAK HAPPENED
According to the Danish Ministry of Research, Higher Education and Digitalisation, on 5 October 2026 the authorities confirmed unauthorised access to the Central Population Register (CPR).
Unknown parties gained access to the names, addresses and personal identification numbers of approximately 8.8 million registered individuals. These included both current residents of the country and people who have moved abroad, as well as the deceased.
The register's administration detected suspicious activity on 2 October, although unauthorised queries had been submitted as early as September. In total, the system contains information on approximately 11 million people.
WHAT IS KNOWN ABOUT THE PASSWORD 123456
As The Copenhagen Post reports, citing Politiken, a person who claimed to be the perpetrator of the attack told journalists that he had gained access through a private company's credentials.
This concerns the IT company Pays ApS, which had a lawful right to access the state register. According to Politiken, at least three accounts, including an administrator account, used the same password "123456".
The publication's source claims that he used previously disclosed credentials of a former employee, after which he created programs to retrieve information from the register.
The company Pays ApS confirmed to the TV channel TV 2 that its lawful access to the system had been used by unauthorised individuals. At the same time, the Danish authorities have not officially confirmed that the breach was caused specifically by a weak password.
HOW THE DANISH AUTHORITIES RESPONDED
The CPR administration blocked the company's access to the register and sent a notification to the Danish data protection authority. The police are investigating the circumstances of the incident.
The Minister for Research, Higher Education and Digitalisation, Christina Egelund, described the incident as extremely serious. The ministry initiated a security review of the register and reported on measures taken to prevent similar cases.
On 9 October, the CPR administration also reminded companies of the mandatory data protection requirements, including appointing a security officer and monitoring the number of queries to the system.
WHAT DATA WAS COMPROMISED
The official information from the CPR administration confirms unauthorised access to the personal data of millions of registered individuals.
At the same time, the review showed that the incident did not affect the names and addresses of people who had made use of special protection for this information.
The identity of the person behind the attack has not been officially established. The Politiken source claimed that he does not intend to sell or publish the information obtained. There is no independent confirmation of his intentions.
The Danish authorities recommended that citizens not share passwords or confidential information by telephone or email, even if the interlocutor already knows their name, address and identification number.
