`123456' password used in Danish CPR data breach

What it is

A news round-up covering the September 2026 abuse of Pays ApS's legitimate CPR search access. Pays is an Odense company with two employees as of July 2026. Several of the round-up's items on the breach carry detail the catalog summary lacks.

How it works

• Entry: The hacker told Politiken that a leaked password of a former employee at a small Danish company gave initial access. One item says the password was "123456". Politiken's review of breach data found at least three Pays accounts, including the administrator, using that password.
• Exfiltration: The hacker says they wrote two programs to pull CPR data and store it outside the system.
• Detection: There was no technical alert. The CPR office noticed an unusually large invoice, because every register search carries a fee. About 14 million searches were billed to Pays's credentials. The CPR office's report said this "far exceeds the company's customer base" and that the company said it did not run the lookups.

Preconditions / Affected

• Any organisation holding paid or delegated access to a national register, where a single credential can query it at volume.
• Roughly 8.8 million people's names, addresses and CPR numbers, including deceased people.

What to do

• For individuals: The Agency for Societal Security recommends a credit warning only for people with specific reasons to suspect fraud. Registrations rose from just under 250,000 on 1 October to about 970,000 on 7 October.
• For engineers: The page gives no remediation steps. The implied lesson is that the only control that fired was billing. Per-credential query-volume alerts, and a check against known-breached or common passwords, would have caught this. Both are my inference, not something the page states.

Caveats

• Timeline conflict: Access ran 10 September to 2 October (21 days 17 hours). A CPR office report to the Data Protection Agency says preliminary findings put the unauthorized activity at about 10 days, ending 20 September. Other items say "ten days". The hacker puts the breach at 11 September. The summary's 21-day figure is therefore the access window, not necessarily the activity window.
• Unverified claims: The hacker's account is unconfirmed. An IT security expert at Defend Denmark called it credible and the method plausible. The hacker says they will not sell or publish the data, but provided Politiken with a file of CPR numbers. A 7 October item says authorities did not know who was responsible.
• Open questions: The minister has launched a security review of the whole register. Whether people will get new CPR numbers is undecided. The Confederation of Danish Industry warns that restricting register access could raise business costs.
• Truncation: Only the first 60,000 of 87,219 characters were available, and the DI item is cut off mid-quote. Anything later on the page is not covered here.