'123456' password linked to Denmark data breach affecting 8.8M people

The Register reports that Denmark's CPR administration confirmed a breach affecting the information belonging to 8.8 million people on October 5, adding that a Danish company's legal access to the CPR system was abused.[1]The Register also reports that Pays ApS managing director Sophie Laursen confirmed on October 9 that it's access had been exploited.[1] The outlet says Pays' website has been taken offline, and the business has not responded to The Register's request for more information[1].According to GBHackers, an investigation by Politiken revealed that at least three accounts within the company, including an administrator account, utilized the password "123456."[2] Malwarebytes says the attacker reportedly used a leaked password associated with a former Pays employee.[3]Citing documents obtained by TV 2, The Register reports that the attacker gained access to the CPR system on September 10 and ran the 14 million automated searches between then and September 20.[1] The Register says ministry official Mikkel Leihardt told a press conference the attack came to light after a department staffer picked up an invoice indicating unusually high activity from Pays.[1]Malwarebytes reports that Politiken reports that the data stolen in those searches belonged to approximately 5.5 million living and 3.3 million deceased people.[3] The Register says the hacker told Danish news outlet Politiken they had no intention of selling or leaking the data.[1]Time News reports that the National Unit for Special Crime (NSK) is investigating the case, though no suspects have been identified as of October 9, 2026.[4]