TV 2 ties Denmark's CPR breach of 8.8 million people to a 123456 password
Denmark's CPR administration says abuse of a company's authorized register access exposed data on about 8.8 million people. TV 2 reports the login, with the password 123456, was tied to a former employee of Pays ApS.
The Watch · Security desk
Key figures: around 14 million searches on the unusually large bill that drew attention to the activity; attackers had access for 21 days; Politiken reports the data belonged to approximately 5.5 million living people.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Searches on the bill that drew attention, around | 14,000,000 searches | 7 | |
| Days attackers had access | 21 days | 6 | |
| Living people, approx. | 5,500,000 people | 11 |
What happened
- According to TV 2, Pays has confirmed that its authorized access to search the CPR system was abused.
- An unusually large bill for around 14 million searches is what drew attention to the breach.
- Politiken reports that the data belonged to approximately 5.5 million living and 3.3 million deceased people.
- Several experts shown Politiken's description of the data and method all find it very likely that its hacker source took part in the leak.
Why it matters
- Who's exposed exposure Politiken says personal numbers and addresses of most living Danes are compromised, and Malwarebytes warns that scammers could use such details to make their messages more convincing.
- Who has to decide decision Firms holding delegated access to a sensitive register face a choice about password-only logins. Malwarebytes recommends rejecting weak passwords and making multi-factor authentication mandatory.
- What it limits constraint Pays sells address updates and CPR cleansing, so heavy searching is part of its normal work. A volume alert on an account like that needs a per-customer baseline to separate normal batches from abuse.
Next story · Security · 5h ago
X attributes more than 13,000 suspended accounts to Iranian, Russian and Chinese influence operationsConfirmed2 publishers
Counting back 21 days from the October 2 shutdown puts the start of the access near September 11 [12][6]. The suspicious activity appears to have stopped on September 20, so the login stayed usable for 12 days after its last abusive searches [13]. If the access began September 11, the 14 million searches fit in a window of at most nine days [14], an average of at least 1.6 million a day [15][7].
Malwarebytes puts the failure on monitoring. It wrote: "That many searches from one account should have been noticed earlier." [16] The publication does not say what Pays's usual search volume was, so the case that the volume was unusual rests on the size of the bill [7].
The password is TV 2's finding. It says an email carrying 123456 appeared in a larger data leak and that this matches its own research [21]. If that account holds, a former employee's login was still working when the attacker used it [21], and it took a password that Malwarebytes says the system should have rejected [18].
The figures line up. Politiken's living and deceased counts add up to the administration's 8.8 million [20]. Politiken also says it is in contact with a hacker who claims to have used a simple method to get into the register [8], and its headline on that story says 8.7 million records were shared with it [10].
Prime Minister Mette Frederiksen, Politiken reports, said: "Det er en hændelse, der ikke burde kunne ske" [19]. Roughly, in English: an incident that should not be able to happen.
What to watch
- Any statement from Pays or the CPR administration on how the login was compromised; it would confirm or contradict TV 2's 123456 account.
- Whether the CPR administration changes the terms for firms with delegated search access, such as mandatory multi-factor authentication or per-account search limits.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence66
Perspective Coverage
5 publishers- Builder
- Builder 24%
- Operator
- Operator 52%
- Investor
- Investor 24%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The CPR administration states it identified a serious security incident in which, by abusing a Danish company's authorized access to the CPR system, unauthorized people gained access to names, addresses, CPR numbers and other information on around 8.8 million people.
- [2]
The attacker reportedly gained access through Pays ApS, an IT company based in Odense.
- [3]
According to TV 2, Pays has confirmed that its authorized access to search the CPR system was abused.
- [4]
Pays offers data updates and CPR cleansing, which lets customers check records against the register to update addresses, identify people who have died and obtain information about changes of address.
- [5]
The hack of the CPR register compromises personal numbers and addresses of the majority of all living Danes.
- [6]
The attackers had access for 21 days before it was shut down on October 2, although the suspicious activity appears to have stopped on September 20.
- [7]
The activity was discovered only after an unusually large bill for around 14 million searches drew attention to it.
- [8]
Politiken is in contact with a hacker who claims to have used a simple method to gain access to the CPR register.
- [9]
Politiken presented a description of the data and the method to several experts, who all find it very likely that the hacker took part in the CPR leak.
- [10]
Politiken's headline on the hacker story says the hacker shares 8.7 million ID-information with Politiken.
- [11]
Politiken reports that the data stolen in those searches belonged to approximately 5.5 million living and 3.3 million deceased people.
- [12]
Twenty-one days before the October 2 shutdown is about September 11, the implied start of the access.
- [13]
The login stayed usable for 12 days after the suspicious activity appears to have stopped.
- [14]
If the access began about September 11, the suspicious activity fits in a window of at most nine days.
- [15]
Around 14 million searches in a window of at most nine days averages at least about 1.6 million searches a day.
- [16]
"That many searches from one account should have been noticed earlier."
- [17]
Malwarebytes recommends that systems giving access to sensitive data enforce authentication that would reject weak passwords and make multi-factor authentication mandatory.
- [18]
The password was so weak that it should have been rejected by the system.
- [19]
Prime Minister Mette Frederiksen said of the hack of the CPR register: "Det er en hændelse, der ikke burde kunne ske".
- [20]
Politiken's counts of living and deceased people add up to 8.8 million, matching the CPR administration's figure.
- [21]
The attacker reportedly used a leaked password associated with a former Pays employee; TV 2 says an email containing the password 123456 had appeared in a larger data leak, and that this account of the initial access matches its own research.
- [22]
Scammers could use personal details from the breach to make their messages more convincing.
Sources
5 independent publishers whose own reporting we read for this story.
- dexerto.comHacker says IT company’s ‘123456’ password let them gain access to 8.8 million records
1 article · October 13, 2026
- malwarebytes.comHow “123456” became the key to almost 9 million personal records
1 article · October 12, 2026
- Hacker shares 8.7 million ID-information with Politiken
politiken.dk
1 article · October 8, 2026
- techspot.comOne of the world's worst passwords, 123456, helped a hacker steal 8.8 million people's data in Denmark
1 article · October 14, 2026
- tomshardware.comHacker claims ‘123456’ password let them breach the Danish national registry, accessing 8.8 million records
1 article · October 13, 2026
Topics and entities
Topics
- Government data security
- Credential security
- Data Breaches
Entities
- Mette Frederiksen
- The Register
- Malwarebytes