How “123456” became the key to almost 9 million personal records

October 12, 2026 2 min read

An attacker reportedly used a leaked password to abuse a company’s legitimate access to Denmark’s population register (CPR). The weak password is remarkable, but the failure to spot millions of unusual searches made the breach worse.

The CPR administration states it identified a serious security incident. By abusing a Danish company’s authorized access to the CPR system, unauthorized people gained access to the names, addresses, CPR numbers, and other information belonging to around 8.8 million people registered in the system. CPR numbers are Denmark’s personal identification numbers.

How could a password so weak that it should have been rejected by the system open the door to so much personal information?

The attacker reportedly gained access through Pays ApS, an IT company based in Odense. According to TV 2, Pays has confirmed that its authorized access to search the CPR system was abused. Pays offers services including data updates and “CPR cleansing,” allowing customers to check records against the register to update addresses, identify people who have died, and obtain information about changes of address.

The attacker reportedly used a leaked password associated with a former Pays employee. TV 2 says an email containing the password 123456 had appeared in a larger data leak, and that this account of the initial access matches its own research.

The attackers had access for 21 days before it was shut down on October 2, although the suspicious activity appears to have stopped on September 20. An unusually large bill for around 14 million searches drew attention to the breach.

Politiken reports that the data stolen in those searches belonged to approximately 5.5 million living and 3.3 million deceased people.

A weak, leaked password opened an authorized route into a sensitive register. That access allowed millions of searches, and the activity was discovered only after an unusually large bill drew attention to it.

How to stay safe

If your organization handles sensitive data:

Don’t reuse passwords or use personal passwords for work accounts. Use a password manager to create and remember strong, unique passwords for you.
For systems that give access to sensitive data, enforce authentication that would reject weak passwords and make multi-factor authentication mandatory.
Monitor for unusual activity. That many searches from one account should have been noticed earlier.

If your data may have been exposed in this breach:

Pro tip: Use Malwarebytes Scam Guard if you’re unsure if a message is legitimate. It can help you determine whether it’s a scam and what to do next.