Pays ApS: How “123456” became the key to almost 9 million personal records

Massive Data Breach Exposes Personal Records of 8.8 Million Danes via Weak Password

A cyberattack on Denmark’s population register (CPR) exposed sensitive personal data of approximately 8.8 million individuals including 5.5 million living and 3.3 million deceased after attackers exploited a weak, leaked password. The breach occurred when unauthorized users abused a legitimate access point belonging to Pays ApS, an IT company in Odense that provides CPR data verification services for clients.

The attackers gained entry using the password "123456", which had been exposed in a prior data leak and was linked to a former Pays employee. Despite the password’s obvious vulnerability, the system failed to block it, allowing the attackers to conduct 14 million searches over 21 days before access was revoked on October 2. Suspicious activity reportedly ceased on September 20, but the breach was only detected after an unusually high billing alert flagged the excessive queries.

The compromised data included names, addresses, and CPR numbers Denmark’s unique personal identification numbers posing significant risks for identity theft and fraud. Authorities confirmed the incident but have not disclosed further details on the attackers’ motives or whether the stolen data has been misused.

The breach highlights critical security failures, including the lack of multi-factor authentication (MFA), weak password enforcement, and delayed detection of anomalous activity. Pays ApS has acknowledged the abuse of its authorized access but has not provided additional public statements. Danish officials continue to investigate the scope and impact of the incident.

Source: https://www.malwarebytes.com/blog/news/2026/10/how-123456-became-the-key-to-almost-9-million-personal-records

Pays ApS TPRM report: https://www.rankiteo.com/company/pays-aps

"id": "pay1791873862",
"linkid": "pays-aps",
"type": "Breach",
"date": "10/2026",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '8.8 million individuals (5.5 '
                                              'million living, 3.3 million '
                                              'deceased)',
                        'industry': 'Data Verification Services',
                        'location': 'Odense, Denmark',
                        'name': 'Pays ApS',
                        'type': 'IT Company'}],
 'attack_vector': 'Exploited weak password',
 'data_breach': {'number_of_records_exposed': '8.8 million',
                 'personally_identifiable_information': 'Names, addresses, CPR '
                                                        'numbers',
                 'sensitivity_of_data': 'High (personally identifiable '
                                        'information)',
                 'type_of_data_compromised': 'Personal records (names, '
                                             'addresses, CPR numbers)'},
 'date_detected': '2023-10-02',
 'description': 'A cyberattack on Denmark’s population register (CPR) exposed '
                'sensitive personal data of approximately 8.8 million '
                'individuals, including 5.5 million living and 3.3 million '
                'deceased, after attackers exploited a weak, leaked password. '
                'The breach occurred when unauthorized users abused a '
                'legitimate access point belonging to Pays ApS, an IT company '
                'in Odense that provides CPR data verification services for '
                'clients. The attackers gained entry using the password '
                "'123456', which had been exposed in a prior data leak and was "
                'linked to a former Pays employee. Despite the password’s '
                'obvious vulnerability, the system failed to block it, '
                'allowing the attackers to conduct 14 million searches over 21 '
                'days before access was revoked on October 2. Suspicious '
                'activity reportedly ceased on September 20, but the breach '
                'was only detected after an unusually high billing alert '
                'flagged the excessive queries.',
 'impact': {'brand_reputation_impact': 'Significant',
            'data_compromised': 'Names, addresses, CPR numbers',
            'identity_theft_risk': 'High',
            'systems_affected': 'Denmark’s population register (CPR) access '
                                'system via Pays ApS'},
 'initial_access_broker': {'entry_point': 'Legitimate access point of Pays '
                                          'ApS'},
 'investigation_status': 'Ongoing',
 'lessons_learned': 'Critical security failures included lack of multi-factor '
                    'authentication (MFA), weak password enforcement, and '
                    'delayed detection of anomalous activity.',
 'post_incident_analysis': {'root_causes': "Weak password ('123456'), lack of "
                                           'MFA, delayed detection of '
                                           'anomalous activity'},
 'recommendations': 'Implement MFA, enforce strong password policies, and '
                    'improve monitoring for anomalous activity.',
 'response': {'containment_measures': 'Access revoked on October 2'},
 'title': 'Massive Data Breach Exposes Personal Records of 8.8 Million Danes '
          'via Weak Password',
 'type': 'Data Breach',
 'vulnerability_exploited': 'Weak password enforcement, lack of multi-factor '
                            'authentication (MFA)'}