Password "123456" linked to the breach of Denmark's national CPR register covering 8.8 million people

Danish authorities disclosed on October 5 that someone misused a private company's lawful search access to the Central Person Register (CPR), the national identity register, and obtained names, addresses and CPR numbers for about 8.8 million living, emigrated and deceased people. People registered with name and address protection were not affected. The company, Odense-based Pays ApS, confirmed on October 9 that its access had been exploited. According to documents reported by TV 2, the intruder ran about 14 million automated searches between September 10 and 20, and the activity was only noticed on October 2, when a ministry employee spotted an unusually high invoice. A person claiming responsibility told Politiken the way in was an account protected by the password "123456", and Politiken reported that at least three Pays accounts, including an administrator account, used it. Authorities have not confirmed the password detail.

Why it matters

If the reporting holds, three identity controls failed at once. A third party with bulk read access to a national identity register authenticated with a password alone, that password was the most common one in existence, and nothing flagged 14 million queries from one customer until a billing review two weeks later. Any of MFA, a blocklist of common passwords (which NIST SP 800-63B requires), or a per-account query ceiling would have stopped or shortened this.

The check for your own estate: list every partner, reseller and integration account that can query identity data in bulk, and confirm each has phishing-resistant or workload credentials, a scope limited to what it needs under least privilege, and volume alerting that fires in hours, not on the next invoice. For Danish residents, the realistic harm is targeted vishing: the ministry has already warned that callers who know your name, address and CPR number are not proof of legitimacy.

Source: The Register