Denmark's Identity Database Hacked Via Weak Password 123456 2026

Denmark's national identity database, known as CPR, suffered a massive data breach after an attacker gained access using one of the weakest passwords imaginable: "123456". The breach exposed the personal data of approximately 8.8 million people, highlighting critical failures in cybersecurity practices.

How the Breach Happened

On September 10, an attacker accessed the Danish civil registration system (CPR) through a company account protected by the password "123456". Over the next ten days, the attacker conducted around 14 million automated searches, according to The Register. The unauthorized access was not detected until October 2, and the CPR administration confirmed the breach on October 5.

The breach occurred because a Danish IT company, Pays ApS, had legitimate access to the CPR system, but their account was compromised due to the weak password. The attacker exploited this access to retrieve names, addresses, and CPR numbers, among other data.

Who Was Affected and What Data Was Exposed

The breach affected roughly 8.8 million individuals, which is more than the entire population of Denmark (around 5.8 million). This discrepancy suggests that the exposed data may include records of deceased individuals or non-residents. The compromised data includes names, addresses, and CPR numbers—the unique identifier used for Danish citizens.

According to Politiken, the attacker has stated they do not intend to sell or leak the data. However, the potential for identity theft and fraud remains high, as CPR numbers are used for a wide range of services, including banking and healthcare.

The Weak Password Problem

The use of "123456" as a password is a glaring example of poor security hygiene. Despite years of warnings, this password consistently ranks among the most commonly used and easily guessable passwords. In this case, it allowed an attacker to bypass what should have been a secure system.

Security experts emphasize that strong, unique passwords and multi-factor authentication are essential for protecting sensitive data. The fact that a company with access to such critical infrastructure used such a weak password is a wake-up call for organizations worldwide.

Detection and Response

The breach was discovered when an employee at the ministry noticed an unusually high activity on an invoice from Pays ApS. This led to the detection of the unauthorized access. The CPR administration has since confirmed the breach and is investigating the incident.

The Danish data protection authority (Datatilsynet) has been informed, and the company Pays ApS is cooperating with the investigation. The attacker's access has been revoked, but the damage is already done.

Implications for Data Security

This incident underscores the importance of robust cybersecurity measures, especially for systems holding sensitive personal data. Weak passwords remain a significant vulnerability, and organizations must enforce strict password policies and regular security audits. The longer history behind the story is traced in FBI Cracks Down on North Korean Remote Work Scams.

Moreover, the breach raises questions about third-party access controls. Companies with privileged access to government databases must be held to the highest security standards. The lack of multi-factor authentication in this case is a critical oversight. The background to this story is set out in Asos Data Breach: Hacker Accessed Customer Data via Trusted Contact. A related thread runs through RNLI Data Breach: Supporters Warned After Cyber Attack. Earlier coverage in Asos Hack Notification Sparks Data Breach Investigation shows how the argument developed.

What to Watch Next

As the investigation continues, authorities will likely review the security protocols of all third-party vendors with access to the CPR system. The incident may also prompt legislative changes to strengthen data protection laws in Denmark. A closer look at the same subject appears in Origin Energy Data Breach: 900,000 Customers Affected. Anyone following the wider picture can start with UK State Investment Agency Data Breach Exposes Officials. The same theme surfaces in UK Investment Agency Data Breach Exposes 51 Officials, which takes a different angle.

For individuals affected, it is advisable to monitor for signs of identity theft and to be cautious of phishing attempts that may use the stolen data. The Danish government is expected to provide guidance on protective measures. Context on how this played out before sits in Dyfed-Powys Police Cyber-Attack: Staff Data Security Breach. A companion piece, Revolut Data Breach: $3M Ransom Demand After Crypto Hack, approaches the same subject from another angle.

Key Takeaways

• The Danish CPR database was breached using the weak password "123456".
• Approximately 8.8 million records were exposed, including names, addresses, and CPR numbers.
• The breach was detected after unusual activity was noticed on an invoice.
• The attacker claims no intention to sell or leak the data.
• The incident highlights the critical need for strong passwords and multi-factor authentication.

Comparison of Password Strength

FAQ