How a ‘123456’ Password Exposed 8.8 Million Danish Identities: The CPR Breach Explained (2026)

When I first read that a two-person IT company with the password “123456” may have exposed the identities of nearly every person in Denmark, I laughed — and then I stopped laughing. I’ve covered data breaches for years, and the pattern is always the same: it’s never the movie-style hack that gets you. It’s the boring stuff. The weak password. The vendor nobody vetted. If you live in Denmark, your fear right now is simple — is my CPR number out there, and what can someone do with it? Here’s my promise: I’ll explain exactly what happened, what was taken, what’s disputed, and the three things you should do today. No hype, just facts.

Trust note: this story has conflicting reports on key details, and I’ll flag every dispute honestly instead of picking the scariest number. Sources are named throughout.

Quick Navigation: What You’ll Learn

• What was stolen: 8.8 million CPR records and how we know
• How a two-employee firm’s account became the entry point
• The ‘123456’ password claim — what’s verified and what isn’t
• Why 14 million searches triggered no automatic shutdown
• The 3 things Danish citizens should do right now

Ready? Let’s get started.

What Happened: 8.8 Million Records, Nearly the Whole Country

On the evening of October 2, 2026, Danish authorities detected an anomaly in the CPR system — the Centrale Personregister, the national identity register that assigns every resident a CPR number used for healthcare, taxation, and virtually every interaction with the state. What they found was staggering: unauthorized access stretching back to September 10, 2026 had extracted data linked to approximately 8.8 million CPR numbers — nearly the entire registered population.

The precise figure, reported by the Danish newspaper Politiken and cited by Cybersecurity News, is 8,749,975 records: 5.5 million living individuals and 3.3 million deceased, out of roughly 11 million total individuals in the CPR system (residents, deceased, and emigrants). The exposed data includes names, addresses, and CPR numbers. The one piece of good news: according to the CPR Administration’s statement, records with protected names and addresses — typically people under witness protection or victims of violence — were not involved.

The Entry Point: A Two-Person IT Firm in Odense

Here’s the part that should make every security professional uncomfortable. The breach was not a zero-day vulnerability in the government’s systems. According to DeafNews’ detailed reconstruction, the entry point was the administrative account of Pays ApS, a micro IT company based in Odense with two employees as of July 2026, which held legitimate, authorized access to search the CPR database.

The company’s managing director, Sophie Laursen, confirmed to TV 2 (reported via the Copenhagen Post and Cybernews): “We can confirm that we are the company that has been subjected to an attack where our legal access to search for information in the CPR system has been abused.” Think about what that means. The attacker didn’t pick the government’s lock — they stole the keys from a contractor and walked in through the front door, then ran automated queries for weeks. The technical mechanism is the abuse of legitimate access, and as Huntress security operations senior manager Dray Agha put it: “A compromised account at a single supplier can bypass an organization’s core security controls and turn a legitimate connection into a massive data exposure.”

The ‘123456’ Password: What We Know and What We Don’t

Now the detail that made global headlines. According to statements from an anonymous hacker reported by Politiken, the attacker used a stolen password from a former employee to access three Pays ApS accounts — at least one with administrative privileges — and the password ‘123456’ is cited in that context. I need to be straight with you: this claim rests solely on the hacker’s own declaration, reported secondhand, with no independent forensic confirmation. The sources themselves present it as “reportedly” or “allegedly.”

What is confirmed is that the credentials were weak enough to be abused and that the attacker reportedly built two automated programs to extract data systematically. CSO Online reports an additional staggering data point: over 14 million searches were conducted through the compromised account, returning approximately 8.8 million records. Fourteen million queries — and nothing automatically shut the access down. That, to me, is the real scandal: not just the weak password, but a national identity system with no anomaly detection capable of flagging millions of abnormal queries from a single vendor account.

The Disputed Timeline: 10 Days or 21 Days?

Here’s where honest reporting gets uncomfortable. The start date — September 10, 2026 — is consistent across sources, and detection on the evening of October 2 is fixed by the CPR Administration’s statement. But the duration of active extraction is disputed: Cybernews cites “21 days and 17 hours,” while CSO Online describes the access period as “about 10 days.” That’s a significant, unexplained discrepancy, and I’ll tell you plainly that I don’t know which is right.

Why does it matter? Because duration tells you about dwell time and intent. Three weeks of extraction suggests a patient, methodical operation; ten days suggests a smash-and-grab. Either way, the outcome is identical for citizens — but for investigators and for the lessons other countries must draw, the difference matters. It’s also unknown whether the attacker acted alone or as part of a structured group, and whether the data was sold or shared beyond its delivery to Politiken. The National Special Crime Unit’s investigation continues, and authorities have disclosed nothing about its status or any sanctions against Pays ApS.

The Official Response: “Deeply Serious”

To their credit, Danish authorities moved once they detected the anomaly. The CPR Administration issued a press release on the evening of October 2 confirming the exposure, revoked Pays ApS’s access, reported the incident to the Danish Data Protection Authority, and launched the investigation with the National Special Crime Unit. Minister Christina Egelund — responsible for Research, Education, and Digitalization — called the incident “deeply serious” and announced a “comprehensive mapping” of the case.

One mitigating factor: Denmark’s MitID two-factor authentication system makes it much harder to directly impersonate someone in government services using a CPR number alone. That’s genuinely good design paying off in a crisis. But — and this is the part citizens need to hear — the combination of real names, real addresses, and real CPR numbers is a goldmine for targeted phishing and social engineering. A scammer who opens with your correct name, address, and ID number doesn’t sound like a scammer anymore.

What Danish Citizens Should Do Right Now

If you’re in Denmark, assume the combination of your name, address, and CPR number is in circulation, and act accordingly. Three things matter most. First, treat every unexpected message with heightened suspicion — phishing emails and texts will now cite your real data to build trust, even ones that appear to come from public authorities. Always verify the sender through an independent channel. Second, make sure MitID is active and correctly configured — it’s your primary shield against direct impersonation; never disable login notifications and refuse unsolicited authentication requests. Third, watch for the “comprehensive mapping” announced by Minister Egelund and request information from the CPR Administration about your own exposure once details emerge.

For the rest of us watching from other countries, the lesson is structural, not Danish. Centralized identity systems are efficient — and they turn every vendor account into a potential single point of failure for millions. Our coverage of the voice-phishing breach that exposed 1.4 million patients’ health data and the n0n ransomware group’s threats against 38 shipping firms shows the same truth from different angles: attackers go where the data is concentrated, and they enter through the weakest door. If you want a practical starting point for your own defenses, read our step-by-step guide to protecting your online privacy in 2026 and our complete phone backup guide — and see how a single private key drained $12.5 million in the 79thVault hack for the crypto version of the same single-point-of-failure lesson.

Frequently Asked Questions

How many people were affected by the Denmark CPR breach?

Approximately 8.8 million CPR numbers were exposed — precisely 8,749,975 according to Politiken, covering 5.5 million living and 3.3 million deceased individuals, out of about 11 million total records in the CPR system.

Was the password really ‘123456’?

An anonymous hacker claimed to Politiken that ‘123456’ was among the credentials used, reportedly a former employee’s password. This has not been independently forensically confirmed — treat it as alleged, not proven.

What data was stolen?

Names, addresses, and CPR numbers. Records with protected names and addresses (witness protection, violence victims) were not involved, per the CPR Administration.

How did the attacker get in?

Through the compromised administrative account of Pays ApS, a two-employee IT firm in Odense with legitimate access to the CPR register — not through a vulnerability in the government system itself.

How long did the unauthorized access last?

Disputed: Cybernews reports 21 days and 17 hours starting September 10, 2026; CSO Online says about 10 days. Detection occurred on the evening of October 2, 2026.

Can criminals impersonate me with just my CPR number?

Direct impersonation of government services is much harder thanks to Denmark’s MitID two-factor authentication. The main risk is highly personalized phishing and social engineering using your real name, address, and CPR number.

What has Denmark done in response?

Authorities revoked Pays ApS’s access, notified the Danish Data Protection Authority, and the National Special Crime Unit is investigating. Minister Christina Egelund called it “deeply serious” and announced a comprehensive mapping of the incident.

Final Thoughts

I’ve covered breaches caused by nation-state hackers, ransomware gangs, and zero-day exploits. This one bothers me more than most — because there was no genius involved. Just a small vendor, a weak credential, and a national system that never noticed 14 million strange queries. The fix isn’t exotic: strong unique passwords, multi-factor authentication on every vendor account, and anomaly detection that actually trips. Congratulations on making it to the end — you’re now better informed about this breach than most news summaries will leave you. If this story changed how you think about your own accounts, tell me in the comments: when did you last change your most important passwords? Be honest. I read every reply.

Published: October 19, 2026 · Updated: October 19, 2026