SecurityIndependently confirmed2 publishers2 min readPublished
TV 2 ties Denmark's CPR breach of 8.8 million people to a 123456 password
Denmark's CPR administration says abuse of a company's authorized register access exposed data on about 8.8 million people. TV 2 reports the login, with the password 123456, was tied to a former employee of Pays ApS.
The Watch · Security desk
Key figures: around 14 million searches on the unusually large bill that drew attention to the activity; attackers had access for 21 days; Politiken reports the data belonged to approximately 5.5 million living people.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Searches on the bill that drew attention, around | 14,000,000 searches | 7 | |
| Days attackers had access | 21 days | 6 | |
| Living people, approx. | 5,500,000 people | 8 |
What happened
- According to TV 2, Pays has confirmed that its authorized access to search the CPR system was abused.
- An unusually large bill for around 14 million searches is what drew attention to the breach.
- Politiken reports that the data belonged to approximately 5.5 million living and 3.3 million deceased people.
- Several experts shown Politiken's description of the data and method all find it very likely that its hacker source took part in the leak.
Why it matters
- exposure Politiken says personal numbers and addresses of most living Danes are compromised, and Malwarebytes warns that scammers could use such details to make their messages more convincing.
- decision Firms holding delegated access to a sensitive register face a choice about password-only logins. Malwarebytes recommends rejecting weak passwords and making multi-factor authentication mandatory.
- constraint Pays sells address updates and CPR cleansing, so heavy searching is part of its normal work. A volume alert on an account like that needs a per-customer baseline to separate normal batches from abuse.
Counting back 21 days from the October 2 shutdown puts the start of the access near September 11 [17][6]. The suspicious activity appears to have stopped on September 20, so the login stayed usable for 12 days after its last abusive searches [18]. If the access began September 11, the 14 million searches fit in a window of at most nine days [19], an average of at least 1.6 million a day [20][7].
Malwarebytes puts the failure on monitoring. It wrote: "That many searches from one account should have been noticed earlier." [9] The publication does not say what Pays's usual search volume was, so the case that the volume was unusual rests on the size of the bill [7].
The password is TV 2's finding. It says an email carrying 123456 appeared in a larger data leak and that this matches its own research [22]. If that account holds, a former employee's login was still working when the attacker used it [22], and it took a password that Malwarebytes says the system should have rejected [12].
The figures line up. Politiken's living and deceased counts add up to the administration's 8.8 million [21]. Politiken also says it is in contact with a hacker who claims to have used a simple method to get into the register [14], and its headline on that story says 8.7 million records were shared with it [16].
Prime Minister Mette Frederiksen, Politiken reports, said: "Det er en hændelse, der ikke burde kunne ske" [13]. Roughly, in English: an incident that should not be able to happen.
What to watch
- Any statement from Pays or the CPR administration on how the login was compromised; it would confirm or contradict TV 2's 123456 account.
- Whether the CPR administration changes the terms for firms with delegated search access, such as mandatory multi-factor authentication or per-account search limits.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap−5
- Incentives
- Insufficient
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The CPR administration states it identified a serious security incident in which, by abusing a Danish company's authorized access to the CPR system, unauthorized people gained access to names, addresses, CPR numbers and other information on around 8.8 million people.
ReportedSupportedSource: CPR administration, as reported by Malwarebytes2 sources— create a free account to open themView cited source - [2]
The hack of the CPR register compromises personal numbers and addresses of the majority of all living Danes.
- [3]
The attacker reportedly gained access through Pays ApS, an IT company based in Odense.
- [4]
According to TV 2, Pays has confirmed that its authorized access to search the CPR system was abused.
- [5]
Pays offers data updates and CPR cleansing, which lets customers check records against the register to update addresses, identify people who have died and obtain information about changes of address.
- [6]
The attackers had access for 21 days before it was shut down on October 2, although the suspicious activity appears to have stopped on September 20.
- [7]
The activity was discovered only after an unusually large bill for around 14 million searches drew attention to it.
- [8]
Politiken reports that the data stolen in those searches belonged to approximately 5.5 million living and 3.3 million deceased people.
- [9]
"That many searches from one account should have been noticed earlier."
- [10]
Malwarebytes recommends that systems giving access to sensitive data enforce authentication that would reject weak passwords and make multi-factor authentication mandatory.
- [11]
Scammers could use personal details from the breach to make their messages more convincing.
- [12]
The password was so weak that it should have been rejected by the system.
- [13]
Prime Minister Mette Frederiksen said of the hack of the CPR register: "Det er en hændelse, der ikke burde kunne ske".
- [14]
Politiken is in contact with a hacker who claims to have used a simple method to gain access to the CPR register.
- [15]
Politiken presented a description of the data and the method to several experts, who all find it very likely that the hacker took part in the CPR leak.
- [16]
Politiken's headline on the hacker story says the hacker shares 8.7 million ID-information with Politiken.
- [17]
Twenty-one days before the October 2 shutdown is about September 11, the implied start of the access.
- [18]
The login stayed usable for 12 days after the suspicious activity appears to have stopped.
- [19]
If the access began about September 11, the suspicious activity fits in a window of at most nine days.
- [20]
Around 14 million searches in a window of at most nine days averages at least about 1.6 million searches a day.
- [21]
Politiken's counts of living and deceased people add up to 8.8 million, matching the CPR administration's figure.
- [22]
The attacker reportedly used a leaked password associated with a former Pays employee; TV 2 says an email containing the password 123456 had appeared in a larger data leak, and that this account of the initial access matches its own research.
ReportedContestedSource: TV 2, as reported by Malwarebytes2 sources— create a free account to open themView cited source
Sources
2 independent publishers whose own reporting we read for this story.
- malwarebytes.comHow “123456” became the key to almost 9 million personal records
1 article · October 12, 2026
- Hacker shares 8.7 million ID-information with Politiken
politiken.dk
1 article · October 8, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Credential securityFollow
- Government Digital InfrastructureFollow
- Data BreachesFollow