Politiken Reports Admin Password Behind Denmark's CPR Breach Was 123456

Someone ran more than 14 million lookups against Denmark's CPR population register using the credentials of Pays ApS, a two-employee company in Odense, and pulled records on about 8.8 million people. Politiken reports that the administrator account's password was 123456.

The digitalisation ministry announced the breach on Monday, Oct. 5. Its public notice says an unauthorised party obtained names, addresses and CPR numbers (Danish personal identity numbers). The notice gives no head count and does not mention a password. The 8.8 million figure comes from The Next Web's account of the ministry briefing, which says people with name and address protection were not reached.

What the attacker needed

The register itself was not broken into. Under Section 38 of the Danish Civil Registration System Act, private companies with a legitimate interest can query CPR, and the administration bills them per lookup. A valid company login was enough, and the only brake was the invoice. The ministry said more than 14 million lookup attempts were made and about 8.8 million returned a record.

1. Lookup attempts (at least)14 million
2. Records returned (ministry)8.8 million
3. Numbers in file shared with Politiken8.7 million

Source: The Next Web, Oct. 6, 2026; Sweden Herald (TT), Oct. 8, 2026. Lookup attempts are reported as 'well over' 14 million.

Ten days of lookups inside a 21-day window

TV 2 documents cited by the CPH Post show the company's access starting Sept. 10 (the person who spoke to Politiken says Sept. 11). A preliminary investigation suggests the unauthorised activity ended Sept. 20, about 10 days in. The CPR administration's invoice arrived on Friday evening, Oct. 2, and Mikkel Leihardt, a department head at the ministry, described its size as the alert. Officers from the National Unit for Special Crime visited the company the next evening to secure evidence.

TV 2's documents put the access window at 21 days and 17 hours, ending Oct. 2. By that measure the credentials stayed usable for 12 days after the lookups investigators attribute to the attacker stopped. The ministry has not named the company. Pays identified itself: managing director and owner Sophie Laursen told TV 2 that its legitimate access "has been abused."

The password claim is one source

The 123456 detail rests on Politiken, which reviewed data from the breach and interviewed an anonymous person who claims responsibility. According to the CPH Post's summary, at least three Pays accounts used 123456, the administrator account among them. The person says access began with a leaked password belonging to a former employee and that the file they shared holds more than 8.7 million CPR numbers. They say they will not sell or publish it.

	Politiken's source	Ministry and police
How access was gained	Leaked password of a former employee, then 123456	A company's legitimate access was abused
Volume	File of more than 8.7 million numbers	About 8.8 million records returned
Suspect	Anonymous, says no sale planned	Nobody identified or charged

Jens Myrup Pedersen of Aarhus University called the password security "hopeless", and Emil Hørning of Defend Denmark said the method was plausible, both per the CPH Post. Nothing from the authorities confirms the password. Leihardt said that "As a system, CPR is intact", and Christina Egelund, the minister for science, higher education and digital affairs, acknowledged the security measures were inadequate and ordered a review of the register with no deadline.

Credentials rather than exploits are also the target in GhostAction, whose fake audit workflow mines Git history for deleted secrets. On the data side, our coverage of the Rampart PII filter shows how unevenly tools that strip personal identifiers from text perform on non-Latin names.

What Danes and companies were told

Laila Reenberg, head of Styrelsen for Samfundssikkerhed, the civil security agency, told companies and authorities to stop accepting a CPR number alone as proof of identity. "You cannot use it to authorise things, to buy something or to get sensitive personal information," she said. A CPR number cannot be rotated like a password, and Egelund said it was too early to say whether anyone will be issued a new one. Henriette Erbs, unit head at the National Unit for Special Crime, said police have identified and charged no one and are contacting police in other countries.