Key points
- The breach exposed information belonging to 8.8 million people in Denmark’s Central Register of Persons.
- Attackers used the password "123456" to access accounts at IT firm Pays ApS.
- The intrusion was detected on October 2, after 14 million automated searches were conducted.
Denmark’s Central Register of Persons suffered a significant data breach affecting 8.8 million individuals, according to confirmation from the CPR administration on October 5. Officials stated that legal access granted to a Danish company was abused, leading to the exposure of sensitive personal information stored in the national database.
By the numbers
- 8.8 million: The number of people whose information was accessed in the breach.
- 14 million: The volume of automated searches conducted by the attacker between September 10 and 20.
- 12 days: The gap between the final reported search activity and the detection of the intrusion on October 2.
What the figures mean
A person claiming responsibility told Politiken that they accessed the system through an IT company account protected only by the password "123456." The newspaper reported that at least three accounts, including an administrator account, shared this weak credential. The government did not initially name the firm, but Sophie Laursen, managing director of Funen-based Pays ApS, confirmed on October 9 that her company’s access had been exploited.
Pays ApS held authorized access to the CPR system to validate business customer records. According to documents obtained by broadcaster TV 2, the attacker gained entry on September 10 and executed 14 million automated searches until September 20. The intrusion remained undetected until October 2, when a staffer noticed an invoice indicating unusually high activity from Pays, as Mikkel Leihardt explained at a press conference.
The CPR register holds approximately 11 million records, including those of deceased individuals and residents who have moved abroad. The claimant stated they had no intention of selling or leaking the data. Pays’ website has been taken offline, and the company has not responded to requests for further information regarding the password vulnerabilities.
What should you do?
Organizations must audit third-party access credentials immediately, ensuring that vendors use strong, unique passwords rather than default or simple strings. Monitor invoices and usage logs for anomalies that might indicate unauthorized automated activity or excessive data queries. Implement multi-factor authentication for all administrative accounts to prevent access via compromised passwords alone.
What to do and how to stay safe: Denmark
- Review all third-party vendor credentials and enforce complex password requirements for any account with access to sensitive databases.
- Implement multi-factor authentication on all administrative and privileged accounts to mitigate the risk of credential theft.
- Monitor system logs and billing invoices for unusual spikes in activity or data queries that could signal unauthorized access.
- Conduct regular audits of authorized access lists to ensure only necessary personnel retain entry to critical systems.
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many people were affected by the Denmark data breach?
Information belonging to 8.8 million people was accessed in the breach of the Central Register of Persons.
What password was used to gain access?
The attacker used the password "123456" to access accounts at the IT company Pays ApS.
How was the breach discovered?
A department staffer detected the intrusion after reviewing an invoice that showed unusually high activity from Pays ApS.
