Attacker held 21-day access to 8.8M Danish records via '123456' password at Pays ApS

An attacker exploited the weak password “123456” at Pays ApS, a Danish IT company, to access national identification data. This incident exposed information tied to approximately 8.8 million records in Denmark’s Central Person Register, according to reports from Cyber Security News and GBHackers.

The breach occurred because Pays ApS, located in Odense on the island of Funen, had legitimate authorization to search the CPR system. The attacker allegedly used credentials belonging to a former employee to gain entry. Instead of breaking into the register’s underlying infrastructure, the intruder abused the company’s trusted access permissions to collect personal data, as noted by Politiken.

Scope and Timeline of the Incident

The alleged attacker provided data to the newspaper Politiken, which reported a total of 8,749,975 records. This figure explains why coverage describes the breach as involving either 8.7 million or roughly 8.8 million entries. The dataset reportedly includes information on around 5.5 million living individuals and 3.3 million deceased persons who were previously registered in Denmark.

Access reportedly began on September 10 and lasted for 21 days and 17 hours, according to the hacker’s claims. This lengthy window raises questions about whether monitoring controls could have detected repeated searches or unusual data collection. Separate reports from authorities indicate about ten days of unauthorized access during September, creating a discrepancy in the timeline that requires further clarification.

Impact on Data Security Practices

Pays ApS confirmed to Danish broadcaster TV 2 that its lawful access to the CPR system had been abused. Managing director and owner Sophie Laursen acknowledged the attack in an email, as reported by The Copenhagen Post. The company had permission to search the register for legitimate business needs, such as verifying customer or member addresses.

This pattern resembles other third-party breaches, such as the Veradigm incident, where stolen vendor credentials allowed attackers to download patient information through approved interfaces. The use of easily guessed passwords across multiple accounts, including an administrator account, highlights serious concerns about credential controls for privileged access.

What should you do?

Organizations with authorized access to sensitive public records must review their password policies immediately. The exposure of CPR numbers and addresses could allow criminals to create detailed victim profiles or craft convincing phishing messages, even if direct access to digital identities remains protected by Denmark’s MitID authentication system.

What to do and how to stay safe: Pays ApS

• Audit all administrative accounts for weak or default passwords, ensuring complex credentials are enforced.
• Review logs for unusual data retrieval patterns or repeated searches that may indicate unauthorized access.
• Monitor for phishing attempts using personal data such as addresses and national ID numbers.
• Verify that third-party vendors with access to sensitive databases adhere to strict security standards.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many records were exposed in the Danish data breach?

Approximately 8.8 million records were exposed, with Politiken reporting a specific count of 8,749,975 entries.

What password was used to breach the system?

The attacker used the password “123456” on at least three accounts, including an administrator account at Pays ApS.

Did the attacker break into the CPR system directly?

No, the attacker abused the legitimate access permissions granted to Pays ApS to search the Central Person Register.