Hacker Used ‘123456’ Password to Access Denmark’s National Registry

A hacker claims to have used the password “123456” to access Denmark’s national population register, exposing personal information belonging to about 8.8 million people in a breach that has raised questions about password security and oversight of third-party access to government databases.

The Danish government disclosed the breach on October 5, saying unauthorised parties had exploited a private company’s legitimate access to the Central Register of Persons, known as CPR, to obtain names, addresses and personal identification numbers. The investigation is ongoing, and authorities have not independently confirmed the hacker’s account of how the intrusion occurred.

The anonymous individual told Danish newspaper Politiken that the password belonged to a former employee of the company and had appeared in an earlier data leak, according to Danish media reports. At least three company accounts, including an administrator account, reportedly used the same password.

The company, Pays ApS, an information technology services provider based in Odense, confirmed that its authorised access to the register had been misused. Its access was intended to support services including the validation and updating of customer records.

The attacker used automated computer programmes to query the register and save the retrieved information externally. The operation involved about 14 million automated searches between September 10 and September 20. The information accessed related to approximately 8.8 million registered individuals, including living people, deceased people and people who had emigrated from Denmark.

The breach was detected on October 2 after authorities noticed irregular activity in the register. The unusually high volume of searches reportedly came to attention after a government employee identified an abnormal invoice associated with the company’s activity.

Denmark’s data protection authority said it had received a report about the incident on October 4 and was examining how the data had been accessed, how the incident had occurred and who was responsible. Police are also investigating the case, the government said.

The government said the unauthorised access did not include names and addresses of people who had registered for name and address protection. It also said it had suspended the company’s access and initiated a security review of the register.

The incident exposes the risks posed by compromised credentials and excessive trust in third-party organisations that handle sensitive government information.

Verizon’s 2025 Data Breach Investigations Report, which analysed more than 22,000 security incidents, including 12,195 confirmed data breaches, found that stolen or misused credentials accounted for 22% of initial access incidents. Exploitation of software vulnerabilities accounted for another 20%, while third-party involvement in breaches doubled to 30% from the previous year’s report.

The findings underscore how attackers can gain access without exploiting a sophisticated software flaw. A compromised account with legitimate permissions may provide a route into sensitive systems, particularly when organisations fail to enforce strong authentication, restrict access or flag unusual activity.

In the Danish case, the reported volume of automated searches also raises questions about why monitoring systems did not identify the activity sooner. The alleged use of a weak password was one part of the incident; the scale of the queries and the delay in detection point to broader questions about access controls and operational oversight.

Private companies can obtain specified information from Denmark’s CPR register when they have a legitimate interest and meet statutory requirements. That arrangement allows businesses to verify records and maintain customer information, but it also creates a potential security risk if authorised access is compromised or misused.

The Danish government said it had initiated measures intended to prevent similar incidents and ordered a thorough security review. Authorities have not yet publicly established the full circumstances of the breach or identified the person responsible.

Stay ahead of the Stories shaping our world. Subscribe to Impact Newswire and join our 
WhatsApp Channel for updates on global tech, business, and innovation—all in one place.

Dive deeper into the future with the Cause Effect 4.0 Podcast, where we explore the ideas, trends, and technologies driving the global AI conversation.

Got a story to share? Contact Us to reach a global audience with Impact Newswire.