One of the most commonly used passwords in the world, “123456”, reportedly gave a hacker access to Denmark’s CPR register, the national system of personal identification numbers. The breach went through Pays ApS, a small IT company in Odense, and exposed information linked to about 8.8 million CPR numbers.
At least three Pays ApS accounts are linked to the breach. The company is listed in the Central Business Register with two employees as of July 2026. Its managing director and owner, Sophie Laursen, confirmed to the broadcaster TV 2 that the firm was the one involved, saying its legal access to the CPR system “has been abused”. The register holds records for about 11 million people, a figure that includes residents, people who have moved abroad and people who have died, so the breach covers the large majority of records held in the register.
An anonymous hacker told the newspaper Politiken that they carried out the attack and that getting in was not especially difficult. According to that account, the intrusion began with a leaked password belonging to a former employee of a small Danish company. Once inside, the hacker reportedly wrote two programs to pull data out of the register and store it elsewhere. The access is said to have started on 10 September and lasted 21 days and 17 hours. The hacker told Politiken they had no plans to sell or publish the data.
The practical risk for Danes depends on how the data is used. MitID, the national two-factor login system, makes it harder for criminals to impersonate someone, so a CPR number alone is not enough to take over an account. However, the numbers can make phishing messages more convincing, and criminals could combine them with information from earlier breaches to build fuller profiles of potential victims.
Danish authorities are urging people to ignore suspicious text messages, calls and emails, and never to share passwords or one-time codes. The case has put a spotlight on how third-party companies with legal access to the CPR system protect that access, since a single weak credential at a two-person firm opened a route into records covering most of the population. Attention is now on what checks such companies face and how quickly access can be withdrawn when staff leave.
