A person claiming responsibility for the Denmark data breach says the password “123456” opened access to the national population register through a company account. The government disclosed the breach on October 5, 2026, confirming that information belonging to 8.8 million people had been accessed.
Key takeaways
- Politiken reported password reuse across three or more company accounts.
- The attacker made 14 million automated CPR searches.
- An invoice showing abnormal activity triggered discovery.
According to The Register, the person described gaining entry through an IT company’s account. Politiken reported that at least three accounts shared the password, including an administrator account.
Denmark data breach exposed population-register information
The accessed information included names, addresses and CPR numbers, Help Net Security reported, citing the ministry. The attackers retrieved information within the categories that private companies were permitted to search.
The register holds approximately 11 million records, making the affected information about 80% of its total. The ministry said the unauthorized access excluded names and addresses covered by name-and-address protection. The 10-digit CPR identifier is used for taxes, healthcare and banking.
Pays ApS confirms abuse of authorized access
Pays ApS had legitimate CPR access for services including checking business customers’ records. Managing director Sophie Laursen confirmed on October 9, 2026, that someone had exploited that access.
The CPR administration initially described abuse of a Danish company’s legal access without naming the business. Pays’ website was subsequently taken offline, and the ministry said the company’s register access had been cut off.
Detection came 12 days after search activity stopped
According to documents obtained by TV 2, the attacker carried out 14 million automated searches during the period from September 10 to September 20, 2026. The breach was not discovered until October 2, 2026, which was 12 days after the last recorded searches took place.
According to Mikkel Leihardt, who directs the government’s higher education and science ministry, the unusual surge in activity was first noticed by a department staff member reviewing an invoice tied to Pays.
Authorities notified and security review requested
Datatilsynet, Denmark’s data protection authority, received notification on October 4, 2026. The government made the incident public the next day.
Help Net Security reported that the authority opened a case examining the incident and responsibility for processing the affected data. Police were also investigating with other authorities.
Minister of Research, Education and Digitalisation Christina Egelund said prevention initiatives had begun and that she had requested a thorough CPR security review. She also informed Parliament’s Business and Digitalisation Committee.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.