A hacker claims an IT company’s ‘123456’ password allowed them to access personal information belonging to 8.8 million people in Denmark’s national population register.
The breach involved Pays ApS, a Danish IT and data services company with authorized access to the country’s Central Register of Persons, known as CPR.
Danish authorities confirmed that someone abused a company’s legitimate access to retrieve names, addresses, personal identification numbers and other information. Pays subsequently confirmed its access had been exploited.
It follows other major security incidents involving outside services, including an October hack of Discord bot Double Counter that exposed millions of users’ IP addresses.
Hacker claims ‘123456’ password opened the door
According to The Register, the person claiming responsibility told Danish newspaper Politiken that an account protected by ‘123456’ provided their way in.
Politiken reported that at least three company accounts used that password, including an administrator account. The alleged hacker said they had no intention of selling or leaking the information.
Malwarebytes reported that the initial access allegedly involved a leaked password associated with a former Pays employee. The company offered services that let customers check their records against CPR, including updating addresses and identifying people who had died.
Documents obtained by Danish broadcaster TV 2 indicated that the attacker gained access on September 10 and carried out around 14 million automated searches through September 20.
The intrusion was discovered on October 2 after an invoice flagged unusually high activity. Pays had not responded to The Register’s questions about the password claims when its report was published.
The case adds to a year of breaches involving government records. In April, researchers reported that a hacker used ChatGPT and Claude to breach Mexican government agencies and steal citizen data.
In Denmark, the affected records reportedly covered approximately 5.5 million living people and 3.3 million deceased people.
The CPR administration said names and addresses belonging to people registered with special name and address protection were not exposed. It has stopped the company’s access, notified the country’s data protection authority and confirmed that police are investigating.
I’m Abhishek Sharma, an author at TigerJek.com. I enjoy exploring games, testing different strategies, and turning what I learn into clear, useful guides. My goal is to help players understand the game better and improve without the usual confusion.
