www.it-connect.fr
Danish Data Leak Exposes 8.8 Million People After Password “123456” Blunder
France is not an isolated case or an exception when it comes to public data leaks. In Denmark, the names, addresses and identification numbers of 8.8 million people, living or dead, were siphoned out of the national CPR register. And at the root of this breach, there appears to be an unbelievable password: 123456.
On October 5, 2026, the Danish Ministry of Research, Education and Digitalisation announced a security incident via an official statement. It reported unauthorized access to the names, addresses and CPR numbers of around 8.8 million registered citizens. "This is a deeply serious incident", said Minister Christina Egelund.
In Denmark, CPR is the central civil registration system. The CPR number is used to identify yourself to government agencies, banks and healthcare services. The register contains around 11 million records, as it includes deceased people and those who have left the country. According to the attacker, the haul includes 5.5 million living people and 3.3 million deceased people.
In this security incident, the attacker used the legitimate access of Pays ApS, a company in Odense that had two employees in July 2026. In Denmark, a company can query the CPR if it can justify a legitimate need to do so. Pays ApS was selling address update and death verification services, according to TV 2.
The embarrassing password: 123456
According to the attacker, who spoke anonymously to the daily Politiken, everything started with the password of a former Pays ApS employee, found in another data breach. Politiken then examined the data: at least three company accounts used the password 123456, including the administrator account. That one is easy to guess even without a data leak... It is frankly hard to understand how some companies are still at this point in 2026...
To reassure our Danish friends, this has a strong déjà vu feeling: I previously published an article about McDonald's recruiting AI, which exposed the data of millions of applicants because of the very same password 123456.
Once in possession of that password, here is what happened:
- Duration: access remained open for 21 days and 17 hours. But according to TV 2, the attacker was only active between September 11 and September 20.
- Volume: more than 14 million requests were sent to the register to retrieve 8.8 million numbers, according to TV 2.
- Detection: no security alert. Since every lookup is billed, it was the abnormally high amount on Pays ApS's invoice that alerted the CPR office on the evening of October 2.
- Tooling: the attacker claims his program was generated by AI, which was confirmed by two experts consulted by Politiken. A bug in the code even made it look for people born in 1877 instead of 1977...
The attacker says he does not want to sell or publish the data, while police investigate. For his part, Jens Myrup Pedersen, professor at Aarhus University, does not mince words: "I struggle to see how security could be worse", he says. He is not wrong.
The same scenario as in France, but worse
This summer, the French state suffered one data leak after another, from the DGFiP to the land registry and the Ministry of Education. Almost every time, it was the same entry point: a compromised legitimate account, sometimes belonging to an authorized third party. Denmark ticks the same boxes, with an aggravating factor: the third party is a two-person company, and above all, the password is just six digits long. But unfortunately, it is also a password that often ranks at the top of the worst-passwords lists...
There is another common point between these incidents: no limit on volume. After its incidents, the DGFiP introduced consultation quotas. In Denmark, a single account chained together millions of requests, and accounting ended up playing the role of the SOC. Once again, there are clearly some gaps...
Since then, the CPR office has written to the 1,039 companies that have access to the register to require a security lead, continuous access monitoring and tracking of the number of monthly transactions, reports DR. The minister, who had called for a full audit of the system as soon as October 5, acknowledged that security was insufficient. As often happens, the response comes after the fact rather than through proactive action.
As often also happens, it is the citizens who will bear the consequences. However, thanks to MitID, the Danish digital identity with two-factor authentication, a CPR number alone is not enough to steal an identity. But it does make more convincing phishing campaigns easier to carry out. The ministry also reminds everyone never to share a password by phone or email, even with someone who seems to know your name, address and CPR number.
What do you think?
