Attacker Used '123456' Password to Breach Denmark's National Registry
An intruder accessed 8.8 million records in Denmark's Central Register of Persons by exploiting weak credentials at a small IT vendor.
Key points
- The breach involved Pays ApS, a company with authorized access to the CPR system.
- The intruder conducted 14 million automated searches between September 10 and September 20.
- Danish authorities confirmed the incident on October 5, citing abuse of legal access.
A person claiming responsibility for the intrusion into Denmark’s Central Register of Persons told Politiken they used the password “123456” to gain entry. This simple credential provided access to an account belonging to Pays ApS, a small IT firm with authorized permissions to query the national database.
The intruder stated they had no intention of selling or publishing the stolen data. According to the newspaper, at least three accounts at the company, including an administrator account, shared this weak password. Pays ApS has taken its website offline and has not commented on the specific password claims to The Register.
How the Intrusion Unfolded
Documents obtained by broadcaster TV 2 indicate the attacker accessed the CPR system on September 10. Between that date and September 20, the intruder executed 14 million automated searches against the registry. The intrusion went undetected until October 2, which was twelve days after the final reported search activity occurred.
Mikkel Leihardt, director of the government’s higher education and science ministry, explained that the breach was discovered after a staff member reviewed an invoice. The invoice showed unusually high activity levels generated by Pays ApS, prompting further investigation into the source of the queries.
Scope and Impact
Denmark’s CPR administration confirmed the breach on October 5, stating that information belonging to 8.8 million people had been accessed. The register holds approximately 11 million records in total, which includes data for deceased individuals and those who have relocated abroad. The government did not name Pays ApS publicly at the time of the initial confirmation.
Sophie Laursen, managing director of the Funen-based company, confirmed on October 9 that Pays ApS had its access exploited. The firm was authorized to access the CPR system to provide services such as validating business customer records. The government declined to answer specific questions regarding the alleged password security failures.
What should you do?
Security teams should audit third-party vendor access to critical national or corporate registries immediately. Organizations must review invoice data and system logs for unusual spikes in query volumes or data retrieval activities. Administrators should enforce strict password complexity requirements for all service accounts, eliminating simple numeric sequences.
What to do and how to stay safe: Denmark
- Review all third-party vendor access logs for unusual volume spikes or off-hours activity.
- Enforce complex password policies for all administrative and service accounts, banning simple sequences.
- Monitor billing and usage invoices from data providers for discrepancies that may indicate automated abuse.
- Verify that all external partners with registry access use multi-factor authentication for login procedures.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many people were affected by the Denmark registry breach?
The Danish government confirmed that information relating to 8.8 million people was accessed during the incident.
Did the attacker sell the stolen data?
The person claiming responsibility stated to Politiken that they had no intention of selling or leaking the data.
How was the breach discovered?
A department staffer identified the intrusion after reviewing an invoice that showed unusually high activity from the vendor.
