Danish CPR register queried through a private company's abused access
Denmark's CPR administration disclosed on October 5, 2026 that a Danish company's lawful access to the national CPR register had been abused to retrieve data on about 8.8 million people. The company, Pays ApS, confirmed its access had been exploited; the attacker ran about 14 million automated searches between September 10 and 20, and the intrusion was detected on October 2.
- Victim
- Danish Civil Registration System (CPR), via the access of Pays ApS
- Industry
- Government
- Country
- Denmark
- Intrusion began
- Sep 10, 2026
- First disclosed
- Oct 5, 2026
- Actor
- Unattributed
- Initial access
- Third-party access
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- 8.8 million (People whose names, addresses and CPR numbers were accessed, per the CPR administration. A person claiming responsibility said the account password was 123456; authorities have not confirmed that.)
- Disclosed cost
- Not disclosed
The identity lesson
A third party's credentials to a national register allowed millions of lookups without challenge. Phishing-resistant MFA for every organization with register access, and rate limits that flag bulk queries, are the controls.
Sources
- '123456' password linked to Denmark data breach affecting 8.8M people, The Register, Oct 13, 2026
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- US Treasury workstations accessed through a stolen BeyondTrust Remote Support key 2024 · Third-party access
- Cisco Duo SMS MFA logs stolen from a phished telephony provider 2024 · Third-party access
- Signal account re-registration via Twilio support console 2022 · Third-party access
- Stolen ConnectWise app credentials open Microsoft 365 tenants across MSP customers 2026 · Third-party access
Cite this record
SWI Community Team. (2026). Danish CPR register queried through a private company's abused access. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-denmark-cpr-register-access-abuse/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.