Danish population register breached; 8.8 million records accessed via '123456' password

Danish authorities have confirmed that the Central Population Register (CPR) was breached in a cyberattack that exposed the personal data of millions of citizens. On October 5, officials confirmed unauthorised access to the names, addresses and personal identification numbers of about 8.8 million people.

Rather than breaking into the state system directly, hackers used the login details of Pays ApS, an IT company authorised to query the registers. Politiken reported that the attacker used leaked accounts of a former employee; at least three accounts, including an admin account, used "123456" as the password. Company director Sofie Laursen confirmed that the access credentials were stolen.

According to The Register, the attackers made 14 million automated queries between September 10 and 20. The incident came to light only on October 2, after the company received an unusually high service fee invoice. The attacker said they did not intend to sell or share the data. Danish law enforcement immediately blocked the company's access to the state register, and a large-scale police investigation has begun.