Someone abused a private company's lawful search access to Denmark's CPR register and pulled names, addresses and CPR numbers for about 8.8 million people. A person claiming responsibility says the account password was 123456.