Major CPR Data Breach in Denmark Linked to Weak Password at Small IT Firm
A hacker accessed Denmark’s Central Person Register (CPR), exposing approximately 8.8 million CPR numbers nearly the country’s entire population after compromising a small IT company, Pays ApS. The breach reportedly stemmed from the use of the notoriously weak password “123456” on an administrative account, which provided access to the national database.
Pays ApS, a two-employee firm based in Odense, confirmed the incident after Danish broadcaster TV 2 reported the breach. The company’s managing director, Sophie Laursen, acknowledged that its authorized access to the CPR system had been abused. An anonymous hacker later told Politiken that the intrusion began with a leaked password from a former employee and lasted 21 days and 17 hours, starting on September 10th. The attacker claimed to have used automated tools to extract data but denied plans to sell or publish it.
The CPR system contains records on roughly 11 million individuals, including residents, expatriates, and deceased persons. While multiple organizations hold authorized access for administrative tasks, the breach highlights vulnerabilities in third-party security practices. Denmark’s reliance on MitID, a two-factor authentication system, limits direct impersonation risks from exposed CPR numbers alone. However, cybercriminals could exploit the data for phishing and social engineering attacks, combining it with other breached information to craft more convincing fraud attempts.
Danish authorities have urged citizens to remain cautious of unsolicited messages containing personal details. The incident underscores the risks of weak security controls in organizations with access to sensitive national infrastructure.
Source: https://cybernews.com/security/denmark-cpr-data-breach-weak-password/
Kollekt cybersecurity rating report: https://www.rankiteo.com/company/trendmatch-aps
"id": "TRE1791801486",
"linkid": "trendmatch-aps",
"type": "Breach",
"date": "9/2026",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"{'affected_entities': [{'customers_affected': '8.8 million individuals '
'(Denmark’s population)',
'industry': 'Technology/IT Services',
'location': 'Odense, Denmark',
'name': 'Pays ApS',
'size': '2 employees',
'type': 'IT Company'}],
'attack_vector': 'Compromised credentials (weak password)',
'customer_advisories': 'Citizens advised to be vigilant against phishing and '
'social engineering attacks.',
'data_breach': {'data_exfiltration': 'Yes (automated extraction over 21 days)',
'number_of_records_exposed': '8.8 million',
'personally_identifiable_information': 'Yes (CPR numbers)',
'sensitivity_of_data': 'High (national identification data)',
'type_of_data_compromised': 'CPR numbers (personal '
'identification numbers)'},
'description': 'A hacker accessed Denmark’s Central Person Register (CPR), '
'exposing approximately 8.8 million CPR numbers after '
'compromising a small IT company, Pays ApS. The breach '
'reportedly stemmed from the use of the notoriously weak '
"password '123456' on an administrative account, which "
'provided access to the national database.',
'impact': {'brand_reputation_impact': 'High (national database breach)',
'data_compromised': '8.8 million CPR numbers',
'identity_theft_risk': 'High (phishing and social engineering '
'risks)',
'systems_affected': 'Denmark’s Central Person Register (CPR)'},
'initial_access_broker': {'data_sold_on_dark_web': 'No (claimed by hacker)',
'entry_point': 'Leaked password from a former '
'employee'},
'lessons_learned': 'Weak security controls in third-party organizations with '
'access to sensitive national infrastructure pose '
'significant risks. Importance of strong password policies '
'and multi-factor authentication.',
'motivation': 'Unknown (claimed no intent to sell or publish data)',
'post_incident_analysis': {'root_causes': "Weak password ('123456') on "
'administrative account, lack of '
'multi-factor authentication, '
'inadequate third-party security '
'oversight.'},
'recommendations': 'Enforce strong password policies, implement multi-factor '
'authentication for administrative accounts, and conduct '
'regular security audits for third-party vendors with '
'access to critical systems.',
'references': [{'source': 'TV 2 (Danish broadcaster)'},
{'source': 'Politiken'}],
'response': {'communication_strategy': 'Public advisories to citizens about '
'phishing risks'},
'stakeholder_advisories': 'Danish authorities urged citizens to remain '
'cautious of unsolicited messages containing '
'personal details.',
'threat_actor': 'Anonymous hacker',
'title': 'Major CPR Data Breach in Denmark Linked to Weak Password at Small '
'IT Firm',
'type': 'Data Breach',
'vulnerability_exploited': "Weak password ('123456') on administrative "
'account'}