In September 2026, an attacker logged into Denmark’s Central Person Register (CPR), the national register that holds every Danish personal ID number, through the legitimate account of Pays ApS, a small IT contractor. The password on that account was reportedly “123456” and had already appeared in an earlier data leak. Over about 21 days the attacker ran roughly 14 million searches and pulled names, addresses and CPR numbers linked to about 8.8 million people. The fix is basic: no shared or weak passwords on privileged access, multi-factor authentication (MFA) on every account that can query sensitive data, and alerts on unusual query volume.

Summary

• The attacker did not break into government systems. The attacker used the authorized CPR access of Pays ApS, an Odense-based data services company with two employees.
• Danish media reported that at least three Pays ApS accounts, including the administrator account, used the password “123456”, and that the password was tied to a former employee and had appeared in an earlier leak.
• About 8.8 million people are affected: roughly 5.5 million living and 3.3 million deceased, according to Politiken.
• The breach was not caught by security monitoring. An unusually large invoice for about 14 million searches alerted the CPR office on October 2, 2026.
• Leaked credentials, missing MFA and unmonitored third-party access are the three failures every organization can check this week.

When legitimate third-party access becomes a backdoor

What happened in the Denmark CPR data breach?

An attacker used the legitimate CPR access of Pays ApS to download personal data at scale. Pays ApS sells data cleansing and address update services, and its contract allowed it to query the register to check whether a person is alive or has moved.

Access reportedly began around September 10, 2026. Suspicious activity appears to have stopped around September 20, but the account stayed active until October 2, when the size of the bill for about 14 million searches drew attention. Access lasted about 21 days in total.

The Danish Ministry of Research, Education and Digitalisation announced the incident on October 5, 2026. Minister Christina Egelund called it “a deeply serious incident” and ordered a full audit of the system. Pays ApS confirmed to the broadcaster TV 2 that its authorized access had been abused.

The exposed data includes names, addresses, CPR numbers and related registry information. A person claiming responsibility told the newspaper Politiken that getting in was not difficult and that they had no plans to sell or publish the data. That claim cannot be verified.

How did a “123456” password lead to 8.8 million exposed records?

The password “123456” was the only control between the internet and a national register. There was no second factor to stop a login with a known, leaked password.

The chain had four links, and each one was preventable:

1. Credential leak: an email address and the password “123456”, linked to a former Pays ApS employee, appeared in an earlier data leak.
2. Password reuse: at least three company accounts, including the administrator account, reportedly used the same password.
3. No MFA: the CPR access accepted a username and password alone.
4. No volume alerts: 14 million automated searches from a two-person company did not trigger an alert. A billing review did.

“123456” has topped common password lists for years. NordPass reported that numeric sequences still dominate those lists, and in Denmark “123456” ranks fourth.

Why does third-party access create this kind of risk?

Third-party access lets attackers skip your strongest defenses. The CPR system itself was not hacked. A small contractor with a valid key was the weakest point, and its security was far below what the register needed.

This pattern is common. According to the Verizon 2026 Data Breach Investigations Report (DBIR), a third party was involved in 48% of breaches, and credential abuse was the entry point in 13%. PhishFort cites both figures as benchmarks in its Digital Threat Intelligence Report for January to June 2026.

National ID databases have been exposed this way before. The 2016 leak of the Turkish citizenship database (about 50 million records) and several exposures of India’s Aadhaar data also involved access paths outside the core system.

Why does a breach of this size matter beyond Denmark?

A CPR number combined with a name and address is enough to make a phishing message look official. The most likely next step is not a sale of the data but targeted fraud against the people in it.

Expect messages that impersonate Danish authorities and services people trust: the tax agency, banks, MitID (Denmark’s digital ID login), pension funds and delivery companies. Messages that quote a real CPR number are harder to dismiss.

The deceased are also at risk. About 3.3 million of the records belong to people who have died, and old identities are used to open accounts and claim benefits because nobody is watching them.

What should security teams learn from the CPR breach?

Treat every account that can query sensitive data as privileged, no matter who holds it. These are the controls that would have stopped this attack, in order of priority:

1. Require MFA on every account with access to sensitive data, including contractor and partner accounts. Password-only access to a national register is not defensible.
2. Block common and leaked passwords at the policy level. Reject “123456” and any password found in known breach lists.
3. Remove access when people leave. Offboarding should disable accounts and rotate any shared credentials the same day.
4. Monitor for leaked credentials. Watch breach dumps and dark web markets for your domains and your partners’ domains, and reset any account that appears.
5. Alert on volume and behavior, not on invoices. A partner that normally runs a few hundred lookups a day and suddenly runs a million should trigger an alert within hours.
6. Scope partner access to the minimum. Least privilege, rate limits and per-query logging limit what a stolen account can pull.
7. Keep only the data you need. Records that are no longer needed should be archived or removed, so a breach exposes less.

How PhishFort helps detect leaked credentials

The CPR breach started with a password that was already public. PhishFort Dark Web Monitoring watches breach dumps, dark web forums, and marketplaces for credentials tied to your domains, so exposed accounts can be reset before someone uses them. When attackers then impersonate your brand with fake sites or accounts, PhishFort handles the takedown.

Frequently asked questions

Sources

• Danish Ministry of Research, Education and Digitalisation, statement of October 5, 2026, as reported by IT-Connect.
• TV 2 and Politiken reporting, as summarized by Malwarebytes (“How 123456 became the key to almost 9 million personal records”, October 12, 2026).
• Cybernews, “World’s worst password 123456 linked to breach of 8.8M Danes”, October 12, 2026.
• Verizon 2026 Data Breach Investigations Report, as cited in the PhishFort Digital Threat Intelligence Report, January to June 2026.