Weak Password Exposes 8.8 Million Records in Denmark’s Population Register
Attackers used a leaked password to abuse authorized access to Denmark’s CPR system, exposing personal data of nearly 9 million people.
Key points
- A weak password associated with a former employee allowed unauthorized access to the Danish CPR system.
- Attackers performed approximately 14 million searches over 21 days before the breach was detected.
- Personal information for roughly 8.8 million living and deceased individuals was exposed in the incident.
An attacker exploited a leaked password to gain unauthorized access to Denmark’s population register (CPR) through a legitimate business partner, exposing the personal records of approximately 8.8 million people. The breach was discovered on October 2 after an unusually large bill for 14 million system searches raised alarms, although suspicious activity had ceased on September 20.
The intrusion occurred via Pays ApS, an IT firm based in Odense that holds authorized access to the CPR database for services such as address verification and data cleansing. According to Malwarebytes Labs, the attacker used a password associated with a former Pays employee that had previously appeared in a larger data leak. The password was “123456,” a string so weak that it should have been rejected by the system’s authentication controls.
Context and Background
The CPR administration confirmed it identified a serious security incident involving the abuse of authorized access. The attackers leveraged the legitimate credentials to query the register extensively. TV 2 reported that the account used for the initial access matched their own research findings regarding the leaked credential. The sheer volume of queries—around 14 million—generated a bill that ultimately drew attention to the unauthorized activity, highlighting a failure in real-time monitoring of unusual search patterns.
Politiken reported that the stolen data belonged to approximately 5.5 million living individuals and 3.3 million deceased people. The exposed information included names, addresses, and CPR numbers, which serve as Denmark’s primary personal identification numbers. The incident underscores how weak authentication and lack of behavioral monitoring can compound the impact of a simple credential leak.
Who Is Affected
Nearly 9 million people registered in the Danish population register had their personal details accessed during the breach. This includes both living citizens and deceased individuals whose records are maintained in the system. The data exposed allows for precise identification, including residential history and unique national ID numbers. There is no confirmed patch or fix for this specific access control failure mentioned in the source material, as the issue stems from credential compromise rather than a software vulnerability.
What should you do?
Individuals whose data may have been exposed should monitor official updates regarding the incident from Danish authorities. They should remain vigilant against phishing attempts and other scams, as attackers often use stolen personal details to craft convincing fraudulent messages. Organizations with similar access to sensitive registers should enforce strict password policies that reject weak credentials and mandate multi-factor authentication to prevent single-point failures.
What to do and how to stay safe: Malwarebytes
- Monitor official communications from the CPR administration for updates on the scope of the breach and recommended actions.
- Be alert to phishing emails or messages that reference your personal details, as scammers may use this data to appear legitimate.
- Ensure you use unique, strong passwords for all accounts, particularly those with access to sensitive data or financial services.
- Enable multi-factor authentication wherever possible to add an extra layer of security beyond just a password.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many people were affected by the Danish CPR breach?
Approximately 8.8 million people, including 5.5 million living and 3.3 million deceased individuals, had their records accessed.
What password was used to gain access to the system?
The attacker used the password “123456,” which was associated with a former employee of Pays ApS.
How was the breach discovered?
The breach was identified after an unusually large bill for around 14 million searches drew attention to the unauthorized activity.
