# Password 123456 exposed 8.8 million Danes

> A hacker accessed Denmark's population registry through a third-party company using a former employee's trivial password, exposing data on millions.
- Title: Password 123456 exposed 8.8 million Danes · TechRadar
- Summary: A hacker accessed Denmark's population registry through a third-party company using a former employee's trivial password, exposing data on millions. An…
- Keywords: denmark, data breach, cybersecurity, central register of persons, weak passwords, third-party security, supply chain attack, technology, Password, 123456, exposed, million
- Source: TechRadar — https://techradar.com/pro/security/123456-password-was-the-only-thing-standing-between-hacker-and-data-of-8-8-million-people
- Published: 2026-10-14T14:10:00+00:00
- Read time: 1 min
- Topics: denmark, data breach, cybersecurity, central register of persons, weak passwords, third-party security, supply chain attack, technology
## 8.8 million Danes exposed
Someone gained unauthorized access to Denmark's Central Register of Persons in September 2026, accessing data on roughly 8.8 million individuals including names, addresses, and CPR identification numbers.
## What is the CPR registry
The Danish Central Register of Persons maintains identifying information about people living in Denmark, including names, addresses, birth dates, citizenship, and marital status.
## Attack through third party
The attacker accessed the registry by abusing a Danish company's legal access to search for information in the CPR system.
## Pays ApS was the gateway
Danish media uncovered that the attack happened through Funen-based Pays ApS, a fact later confirmed by managing director Sophie Laursen.
## Fourteen million searches in ten days
Local TV station TV two said the attacker ran fourteen million automated searches in ten days.The attacker created two scripts to pull information out of CPR and into a third-party system using stolen login credentials.
## Password was 123456
Local publication Politiken spoke to the attacker via encrypted chat.The threat actor said they used login credentials of a former employee whose password was 123456.Three separate accounts were found all using the same simple password.

> 123456
## Hacker claims no intent to leak
The threat actor confirmed they have no intention of leaking or selling the stolen data and said they were really shocked by how poor the security posture was.

> really shocked
## Data could enable targeted attacks
Names, addresses, birth dates, and CPR numbers used in healthcare, taxation, and banking are valuable information that can be used in highly tailored phishing attacks resulting in ransomware infections and wire fraud.
## Key takeaway

An attacker breached Denmark's Central Register of Persons and accessed records on 8.8 million people using login credentials with the password 123456.