A hacker recently breached Denmark’s national population database after reportedly using the password “123456.” As a result, the attack exposed personal data of roughly 8.8 million people, more than the country’s living population of about six million.
The attacker exploited Pays ApS’s legitimate access to Denmark’s Central Person Register (CPR). The private Danish company had authorization to search the register for specific individuals. However, the hacker told Danish newspaper Politiken that at least three company accounts all used the password “123456.” They then built two automated scripts and ran about 14 million searches over 10 days in September, according to TV 2.
Overall, the CPR database holds about 11 million records, including those of deceased and emigrated citizens. The exposed data includes full names, home addresses, and CPR identification numbers. Denmark uses these numbers across healthcare, banking, and taxation. Consequently, security experts warn the stolen data could fuel targeted phishing, identity fraud, and financial scams.
A government employee first noticed unusual activity on October 2 through an invoice showing abnormally high search volume. Denmark’s digital affairs minister then called it “an extremely serious incident.” Authorities also blocked Pays ApS’s access and notified the Data Protection Agency on October 4. In addition, the government publicly confirmed the breach the following day.
The hacker has since approached media outlets to explain his view point, saying they had no plans to sell or leak the data. They also said they were “really shocked” by how poor the security was. The affected company also took its website offline shortly after the news broke. However, police have not named or arrested any suspect so far.
