'123456' password was the only thing standing between hacker and data of 8.8 million people

Attackers reportedly accessed Denmark’s population registry through a third-party company using weak credentials Data on roughly 8.8 million individuals may have been exposed, including CPR identification numbers Breach highlights severe third-party security failures, with reports citing passwords like “123456” Data held by the Danish national population registry was allegedly protected by a very strong, very difficult-to-crack password: 123456.

This claim was made by a person who allegedly broke into the registry in September 2026, accessing data on 8.8 million people.

Might as well been without a password The Danish Central Register of Persons (CPR) is the country’s national population registry that maintains identifying information about people living in Denmark, including their names, addresses, birth dates, citizenship, and marital status.

Each individual is assigned a unique 10-digit CPR number which is widely used in healthcare, taxation, banking, and more.

In a press release, CPR disclosed that someone gained unauthorized access to its systems “by abusing a Danish company’s legal access to search for information in the CPR system.” It explained that private companies with a legitimate interest can pull information from CPR about “a larger, limited group of persons whom the company has identified in advance individually.” So, this was a supply chain attack, in which someone accessed names, addresses, CPR numbers, and other details, on roughly 8.8 million people, through a privately-owned third party.

What’s also interesting is that the entire Danish population counts just over six million people, according to Worldometer - but CPR says it holds some 11 million records, including deceased individuals, as well as those living abroad.

The initial press release did not say who the attacker was, or which company was abused in the attack.

It said the investigation was still ongoing and that CPR made moves to strengthen its security posture.

However, Danish media uncovered that the attack happened through a Funen-based Pays ApS, a fact that was later confirmed by managing director Sophie Laursen.

Pays was authorized to access the CPR system, and the intrusion was spotted when, at the end of the month, a government employee saw an unusually high activity log from Pays for the previous month.

Local TV station TV 2 said the attacker ran 14 million automated searches in ten days.

In the meantime, Pays’ website was taken offline.

At press time, it was operating normally, though.

"Really shocking" The story gets better still.