Denmark Suffers Massive Data Breach Affecting 8.8 Million People Due to Weak Password Security
In a major cybersecurity incident, Denmark’s national population register was breached in September 2026, exposing sensitive data belonging to 8.8 million individuals nearly 80% of the country’s population. The breach was disclosed by the government on October 5, 2026, after an attacker gained unauthorized access through a company account secured with the password "123456."
The attacker exploited a vulnerability at Pays ApS, an IT company with legitimate access to the Central Person Register (CPR) for business verification purposes. Between September 10 and 20, 2026, the intruder conducted 14 million automated searches, extracting names, addresses, and CPR numbers Denmark’s unique 10-digit identifiers used for taxes, healthcare, and banking. While records under name-and-address protection were spared, the exposed data represents a significant privacy risk.
The breach was discovered on October 2, 2026, when a government employee reviewing an invoice from Pays noticed abnormal search activity 12 days after the last unauthorized access. Investigations revealed that the password "123456" was reused across at least three company accounts, including an administrator account, as reported by Politiken. Pays ApS confirmed the abuse of its authorized access on October 9, 2026, after which its website was taken offline and its CPR access revoked.
Denmark’s data protection authority, Datatilsynet, was notified on October 4, 2026, and promptly launched an investigation into the incident and data processing responsibilities. Police were also engaged, while Minister of Research, Education and Digitalisation Christina Egelund announced a security review of the CPR system and briefed Parliament’s Business and Digitalisation Committee on prevention measures.
The breach underscores the risks of password reuse and weak authentication, particularly for systems handling sensitive national data. With 11 million records in the CPR, the incident ranks among Denmark’s most severe cybersecurity failures to date.
Source: https://en.cryptonomist.ch/2026/10/13/denmark-data-breach-cpr/
Smooth Robotics ApS cybersecurity rating report: https://www.rankiteo.com/company/smooth-robotics-aps
"id": "SMO1791910240",
"linkid": "smooth-robotics-aps",
"type": "Breach",
"date": "9/2026",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"{'affected_entities': [{'industry': 'Business Verification Services',
'location': 'Denmark',
'name': 'Pays ApS',
'type': 'IT Company'},
{'customers_affected': '8.8 million',
'industry': 'Public Sector',
'location': 'Denmark',
'name': 'Denmark (National Population)',
'size': '8.8 million individuals',
'type': 'Government/Population'}],
'attack_vector': 'Weak Password Security',
'data_breach': {'data_exfiltration': 'Yes (names, addresses, CPR numbers '
'extracted)',
'number_of_records_exposed': '8.8 million individuals (14 '
'million automated searches)',
'personally_identifiable_information': 'Names, addresses, CPR '
'numbers',
'sensitivity_of_data': 'High (CPR numbers used for taxes, '
'healthcare, and banking)',
'type_of_data_compromised': 'Personally Identifiable '
'Information (PII)'},
'date_detected': '2026-10-02',
'date_publicly_disclosed': '2026-10-05',
'description': 'In a major cybersecurity incident, Denmark’s national '
'population register was breached in September 2026, exposing '
'sensitive data belonging to 8.8 million individuals—nearly '
'80% of the country’s population. The breach was disclosed by '
'the government on October 5, 2026, after an attacker gained '
'unauthorized access through a company account secured with '
"the password '123456.' The attacker exploited a vulnerability "
'at Pays ApS, an IT company with legitimate access to the '
'Central Person Register (CPR) for business verification '
'purposes. Between September 10 and 20, 2026, the intruder '
'conducted 14 million automated searches, extracting names, '
'addresses, and CPR numbers—Denmark’s unique 10-digit '
'identifiers used for taxes, healthcare, and banking. While '
'records under name-and-address protection were spared, the '
'exposed data represents a significant privacy risk.',
'impact': {'brand_reputation_impact': 'Significant privacy risk, severe '
'cybersecurity failure',
'data_compromised': 'Names, addresses, CPR numbers (unique '
'10-digit identifiers)',
'identity_theft_risk': 'High (CPR numbers exposed)',
'operational_impact': 'Pays ApS website taken offline, CPR access '
'revoked',
'systems_affected': 'Central Person Register (CPR), Pays ApS '
'systems'},
'initial_access_broker': {'entry_point': 'Company account with weak password '
"('123456')",
'high_value_targets': 'Central Person Register '
'(CPR)',
'reconnaissance_period': '2026-09-10 to 2026-09-20'},
'investigation_status': 'Ongoing (Datatilsynet and Danish Police)',
'lessons_learned': 'Risks of password reuse and weak authentication for '
'systems handling sensitive national data',
'post_incident_analysis': {'corrective_actions': 'Security review of CPR '
'system, revocation of Pays '
'ApS access',
'root_causes': "Weak password ('123456') reused "
'across multiple accounts, '
'including an administrator '
'account'},
'recommendations': 'Security review of the CPR system, prevention measures '
'for weak passwords and unauthorized access',
'references': [{'source': 'Politiken'}],
'regulatory_compliance': {'legal_actions': 'Investigation by Datatilsynet '
'(Danish Data Protection '
'Authority)',
'regulatory_notifications': 'Datatilsynet notified '
'on 2026-10-04'},
'response': {'communication_strategy': 'Government disclosure, parliamentary '
'briefing',
'containment_measures': 'Pays ApS website taken offline, CPR '
'access revoked',
'law_enforcement_notified': 'Yes (Danish Police)'},
'stakeholder_advisories': 'Parliament’s Business and Digitalisation Committee '
'briefed on prevention measures',
'title': 'Denmark Suffers Massive Data Breach Affecting 8.8 Million People '
'Due to Weak Password Security',
'type': 'Data Breach',
'vulnerability_exploited': 'Password reuse and weak authentication (password: '
"'123456')"}