Denmark Data Breach Exposes 8.8M People: '123456' Password Reported

One of the world's most predictable passwords may have contributed to a data breach involving the personal information of approximately 8.8 million people in Denmark.

An individual claiming responsibility for breaching Denmark's Central Register of Persons (CPR) told the Danish newspaper Politiken that they obtained a leaked password belonging to a former employee of a Danish company. Separately, according to The Register's Oct. 13 report, Politiken reported that at least three Pays ApS accounts, including an administrator account, used the password "123456."

Danish authorities have confirmed unauthorized access to the registry but have not publicly established that the weak password was the initial entry point. New reporting also suggests the alleged attacker used AI-generated code to automate the retrieval of personal information, raising concerns about third-party security, privileged account protection, and the monitoring of suspicious database activity.

How the '123456' password was linked to the breach

Denmark's Central Register of Persons contains approximately 11 million records covering current residents, deceased individuals, and people who previously lived in the country.

In an Oct. 5 government disclosure, Danish authorities confirmed that unauthorized individuals had exploited a private company's legitimate access to the registry, thereby gaining access to personal information of approximately 8.8 million people.

Danish authorities confirmed unauthorized access to names, addresses, CPR numbers, and other information of approximately 8.8 million registered individuals. The government said protected names and addresses were excluded from the unauthorized access, and the full extent of the information obtained remained under investigation.

The government said its investigation remained ongoing. The 8.8 million figure includes deceased individuals and former residents, rather than representing Denmark's current population. The company involved was Pays ApS, whose managing director, Sophie Laursen, confirmed on Oct. 9 that its legitimate access to search the CPR registry had been abused.

The individual claiming responsibility told Politiken that they created two computer programs to retrieve CPR information and store it externally. Danish authorities have not independently confirmed that account of the intrusion.

According to reporting by Danish news outlet Ritzau, the individual provided Politiken with a file containing CPR numbers. The newspaper forwarded the file to a cybersecurity expert, who considered the attacker's account plausible. In additional reporting published Oct. 13, Ritzau said the alleged attacker claimed to have used an AI-generated program to retrieve 8,749,975 CPR numbers.

Two experts examined more than 40,000 lines of code and concluded that it appeared to be AI-generated. Their assessment concerned the code's apparent origin, not independent confirmation of the claimed number of retrieved records.

According to Politiken's reporting, the program mistakenly searched for people born in 1877 rather than 1977, leaving CPR numbers associated with the 1977 birth year absent from the material the alleged attacker shared with the newspaper.

Danish authorities have not independently confirmed the attacker's claimed extraction total.

According to documents obtained by Danish broadcaster TV 2, the unauthorized party had access to the CPR system for approximately 21 days and 17 hours, beginning September 10.

Approximately 14 million automated lookups were made through the company's authorized access, reportedly to identify valid CPR numbers. Preliminary findings suggest the unauthorized activity stopped around Sept. 20, although the compromised access remained available until Oct. 2, when authorities discovered the incident and terminated the company's access.

According to Denmark's Data Protection Agency, the breach notification described numerous automated searches intended to identify valid CPR numbers. The agency received the notification on Oct. 4 and began investigating the incident, including how it occurred and who was responsible for processing the affected personal information.

The approximately 14 million searches represent database queries, while 8,749,975 is the alleged attacker's claimed number of CPR numbers retrieved. Danish authorities have confirmed unauthorized access affecting approximately 8.8 million registered people, but the exact amount of information ultimately extracted and retained remains uncertain.

The government publicly disclosed the incident on Oct. 5. At a press conference the following day, Mikkel Leihardt, a department head at Denmark's Ministry of Research, Education and Digitalisation, explained that authorities had discovered the breach after identifying unusually high charges for the company's CPR registry searches, according to Ritzau.

The individual claiming responsibility reportedly said they did not intend to sell or publish the information. That assertion has not been independently verified and does not eliminate the possibility of identity theft or other misuse.

The incident illustrates how organizations can expose sensitive information through trusted external partners, even when attackers do not directly compromise the database owner's systems.

A related example is the BigCommerce third-party application security incident, which highlights the broader risks organizations face when external integrations have access to customer information.

What the Denmark breach means for security teams

The reported password is the most striking detail, but the larger concern is how an account with legitimate access could reportedly conduct millions of database searches without triggering a timely response.

The alleged use of AI-generated code adds another dimension. Attackers may be able to automate large-scale data collection without developing sophisticated tools from scratch, making effective access controls and behavioral monitoring especially important.

For security teams responsible for sensitive customer information, the incident highlights four priorities: strengthening authentication, restricting third-party access, monitoring unusual activity, and improving identity verification.

Strengthen authentication and privileged account security

Organizations should prohibit the use of commonly used and compromised passwords, require unique credentials, and implement phishing-resistant multifactor authentication wherever supported.

Security teams should also regularly review privileged accounts, revoke access when employees leave, and rotate credentials when necessary. These practices align with the identity governance and authentication controls discussed in eSecurityPlanet's guide to identity and access management solutions.

However, even strong authentication cannot prevent every attack involving compromised sessions or stolen credentials. Organizations must also monitor what authenticated accounts do once they gain access.

Restrict third-party access to sensitive databases

External vendors should receive only the permissions necessary to perform their assigned functions.

For example, a company authorized to verify individual customer records may not require unrestricted access to millions of database entries.

Security teams should:

• Apply least-privilege permissions and regularly review administrative and third-party accounts.
• Establish rate limits and alerts for unusual database searches, bulk retrieval, and automated queries.
• Revoke unnecessary credentials and monitor vendor activity for deviations from normal usage patterns.

These safeguards can limit the damage caused by compromised accounts, even when an attacker successfully authenticates.

The risks associated with external access are also discussed in eSecurityPlanet's analysis of the 2026 Verizon Data Breach Investigations Report, which examines third-party involvement and other factors contributing to modern cyber incidents.

Detect suspicious activity after successful authentication

The approximately 14 million reported searches underscore the importance of monitoring authenticated activity.

Security teams should investigate unexpected spikes in database queries, unusual access times, and repeated requests involving large numbers of personal records. Behavioral analytics, database activity monitoring, and automated alerts can help identify suspicious patterns before extensive data extraction occurs.

Unexpected billing charges and unusually high API consumption may also provide useful warning signals, but they should supplement dedicated security monitoring rather than serve as the primary detection mechanism.

Strengthen identity verification to prevent fraud

The breach also demonstrates the risks of relying on personal information as proof of identity. Names, addresses, dates of birth, and national identification numbers may help identify customers, but they should not, on their own, establish authorization to access or modify an account.

Denmark's Immigration Service and Agency for International Recruitment and Integration introduced additional identity-verification checks for telephone inquiries following the breach, illustrating how organizations may need to strengthen authentication procedures after personal identifiers are exposed:

• Organizations handling sensitive information should use stronger verification methods, including Denmark's MitID system where appropriate, one-time codes delivered through previously verified channels, or callbacks to established telephone numbers.
• Financial institutions, healthcare providers, and government agencies should review procedures for password resets, account recovery, and changes to sensitive customer information.
• For individuals whose information may have been exposed, personal identification numbers combined with other identifying details could make phishing and impersonation attempts more convincing.
• Affected individuals should follow official Danish government guidance, remain cautious about unsolicited communications, and avoid providing passwords or confidential information to unverified callers or email senders.
• For security leaders, the central lesson is that successful authentication should never automatically establish trust.

The Denmark incident highlights why organizations need layered protections that extend beyond password policies. Strong authentication, restricted third-party permissions, continuous monitoring, and reliable identity verification must work together to limit what attackers can accomplish with compromised credentials.

A single stolen credential should not provide an unchecked pathway to millions of sensitive records.

Related reading: For another example of third-party security risks, read eSecurityPlanet's report on the ManoMano data breach affecting nearly 38 million customers, which highlights how compromised vendors can expose sensitive customer information.