A major cybersecurity breach involving Denmark's Central Register of Persons (CPR) reportedly exposed approximately 8.8 million records after an attacker allegedly exploited weak passwords used by a third-party IT services company with authorised access to the database.
According to a report by Tom's Hardware, an individual claiming responsibility for the incident said the password “123456” was used to gain access through an account associated with Pays ApS, a Danish IT and data services provider. The compromised records reportedly included names, addresses, national identification numbers and other personal information belonging to living and deceased individuals.
The alleged attacker claimed that the breach did not involve directly penetrating the government registry's core systems. Instead, access was reportedly obtained through credentials belonging to the external service provider, which had permission to retrieve information from the CPR database.
Also Read | Layoffs Are Rising In Tech, But These Skills Are Helping People Unlock Better Pay
ALSO READ | Cabinet Approves IDBI Bank Stake Sale To Fairfax For Rs 52,878 Crore; FM Calls It Strategic Restructuring
Investigative findings cited in reports indicated that multiple accounts at the company, including an administrative account, allegedly used the same weak password. Scripts were reportedly deployed to extract large volumes of records from the database, Tom's Hardware reported.
The unauthorised activity is believed to have continued for an extended period before being detected. Reports differ on the duration, with accounts describing a delay of around 12 days and others suggesting that access went unnoticed for nearly 22 days.
In Denmark, a "123456" password was linked to a breach of a civil registration database impacting 8.8 million people. https://t.co/2nWFUehYoX
— Pubity (@pubity) October 14, 2026
The breach reportedly came to light after unusual database usage generated an unexpectedly high invoice, prompting scrutiny of the activity. Pays ApS managing director Sophie Laursen reportedly confirmed that the company's authorised access to the registry had been abused. However, the specific password and other technical details attributed to the attacker have not all been independently confirmed by authorities.
The individual claiming responsibility reportedly said they did not intend to sell the stolen information or make it publicly available. Nevertheless, the scale of the incident has raised concerns about the potential misuse of sensitive personal data and the security of third-party providers connected to government databases.
ALSO READ | Sold Gold Jewellery? How To Report Gains In ITR
The incident has renewed scrutiny of password management, administrative account security and oversight of external organisations handling sensitive information. Cybersecurity experts generally recommend enforcing strong, unique passwords, enabling multi-factor authentication and monitoring unusual database queries to reduce the risk of similar attacks.
The case also highlights how vulnerabilities in third-party systems can expose large databases even when the core government infrastructure is not directly compromised. Investigations into the breach and its full implications remain significant for assessing the extent of the exposure and potential risks to affected individuals.
Essential Business Intelligence, Sharp Market Insights, Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.
