Names, addresses and personal ID numbers of about 8.8 million people were accessed from Denmark’s population register, known as CPR. The attackers did not break into the state system. They used the lawful access of a small private IT company, whose administrator password was reportedly “123456”.
What happened?
Denmark’s ministry responsible for digitalisation announced the breach on 5 October. The perpetrators misused a Danish private company’s legitimate access to CPR. They stayed within the data such companies may normally look up: names, addresses and CPR numbers.
The register holds about 11 million records, including people who have died or emigrated. People with name and address protection were not affected. Irregular activity took place during September, but the CPR administration only became aware of it on the evening of 2 October.
The company’s access was shut off, the Danish Data Protection Agency was notified and the police are investigating. A thorough security review of CPR has been ordered. Christina Egelund, Denmark’s minister for research, education and digitalisation, called it “an extremely serious incident”.
How did the attackers get in?
On 12 October, Estonia’s Information System Authority (RIA), citing the Danish newspaper Politiken, wrote that the attackers exploited very easily guessable administrator passwords at the company. Cybersecurity News names the company as Pays ApS, an IT firm in Odense. At least three of its accounts, including an administrator account, reportedly used the password “123456”. According to the same reports, the access began on 10 September and lasted 21 days and 17 hours.
These are media reports, not the findings of an official investigation. The password detail comes from Politiken and the attacker’s own account, and the ministry has not named the company. Pays confirmed to the broadcaster TV 2 that its access had been abused.
Why does this matter for a small business?
The weak link was not the national register. It was a small supplier with a lot of access. Many small companies hold similar access themselves: to public registers, bank interfaces or a client’s systems. And their IT partner often has administrator access to their email, website and accounting.
That does not make every supplier a risk. It does mean your data is only as well protected as the weakest password anywhere along that chain. If an account is protected by a second step, such as a code on a phone, a guessed password alone is not enough to get in.
The leaked data also makes scams more convincing. The Danish authorities warn people never to give out passwords or confidential information by phone or email, even if the caller knows their name, address and ID number.
What should you do?
- List who has access. Write down every administrator and integration account, both yours and your IT partner’s. Close the ones nobody uses any more. If you suspect an account has been misused, change its password and report it (in Estonia, to CERT-EE at cert@cert.ee).
- Require multi-factor authentication. Turn it on for every administrator, email and integration account, without exceptions for “service” accounts.
- Ban simple passwords. Every account needs a long, unique password. A password manager makes that easy for staff.
- Ask your IT partner in writing. Who at their firm can reach your systems? Do their own accounts use multi-factor authentication? How quickly would they tell you about an incident?
- Watch for unusual use. In Denmark, irregular activity in September was only spotted in October. Ask for alerts when an account makes far more requests than usual.
- Warn your staff. Passwords and verification codes are never given out by phone or email, however much the caller seems to know.
If you want to know which weak spots in your website and applications are visible from the outside, our security check can help.
Sources
- Danish Ministry: Omfattende uautoriseret adgang til borgeres CPR-oplysninger (press release, 5 October 2026)
- Euronews: Hackers access data of 8.8 million people in Denmark in 'extremely serious' breach
- RIA: Rahvusvaheline ülevaade, 41. nädala olulisemad küberuudised (in Estonian)
- Cybersecurity News: Admin Password "123456" Led to 8.8 Million Danish ID Data Breach
We used AI to help write this post. The facts come from the sources listed below and reflect what was known on the day the news broke. How we use AI.
