Denmark's Central Register of Persons (CPR) had information relating to 8.8 million people accessed after an intruder exploited a third party's legal credentials, officials and reporting say.
Denmark's CPR register: scope of the exposure
The Danish government has confirmed that information relating to 8.8 million people was accessed in the incident. The CPR register holds roughly 11 million records in total — the larger dataset includes records for deceased people and those who have moved abroad. The government's public statement on October 5 identified the scale of affected records but did not name the third party whose access was abused.
Alleged access vector: an IT company account and the password "123456"
A person claiming responsibility told the Danish newspaper Politiken that they gained entry to the CPR system through an IT company account protected by the password "123456." Politiken also reported that at least three company accounts, including an administrator account, used the same password. The person who claimed responsibility told Politiken they had no intention of selling or leaking the data.
The CPR administration said the breach involved abuse of a Danish company's legally authorised access. Without naming the firm, the administration confirmed the breach on October 5. Funen-based Pays ApS was later identified publicly: Pays' managing director, Sophie Laursen, confirmed on October 9 that the company's access had been exploited. Pays' website has been taken offline and the business did not respond to The Register's request for more information about the password claims.
Pays had authorised access to the CPR system to perform services such as validating business customers' records.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadTimeline: intrusion, automated queries and detection
- According to documents obtained by broadcaster TV 2, the attacker first gained access on September 10.
- Between September 10 and September 20 the intruder ran 14 million automated searches against the register.
- The intrusion was detected on October 2 — twelve days after the last reported automated searches.
At a press conference, Mikkel Leihardt, director of the government's higher education and science ministry, said the attack was discovered after a department staffer noticed an invoice indicating "unusually high activity from Pays."
Notifications, disclosure and unanswered questions
The Danish data protection authority, Datatilsynet, was notified on October 4. The government publicly disclosed the attack on October 5. The CPR administration confirmed the breach the same day, reiterating that a Danish company's legal access to the system had been abused. The government did not respond to questions about the alleged password failings.
What this means for technologists, regulators, and the public
- Technologists and security teams: The reporting highlights the role of third‑party, authorised accounts in enabling large-scale queries; the intrusion involved multiple automated searches (14 million) and allegedly exploited accounts sharing the same simple password across at least three company accounts, including an administrator account.
- Regulators and oversight bodies: Datatilsynet received notification on October 4; government disclosure followed on October 5. Regulators will be positioned to review the circumstances of authorised access, the detection gap between September 20 and October 2, and the legal obligations tied to third‑party use of CPR data.
- The public and individuals whose records appear in the CPR: The government says data relating to 8.8 million people were accessed. The register contains about 11 million records overall, a set that includes deceased persons and those who have moved abroad; individuals will be directly affected if their records are among those accessed.
The sequence of claims and confirmations in this case leaves concrete operational details still to be clarified publicly: the government has confirmed the scale and that authorised access was abused, Pays' managing director has acknowledged exploitation of the company's access, and the person claiming responsibility has pointed to the simple password "123456" and said they did not intend to sell or leak the data. With Pays' website taken offline and the government not answering questions about the alleged password failings, the next public steps are likely to focus on detailed forensic findings, regulator actions, and any remedial measures tied to the CPR system and authorised third parties.
