Major Danish Data Breach Exposes 8.75 Million Records Due to Weak Passwords
A significant cybersecurity incident in Denmark has compromised 8.75 million records from the country’s Central Person Register (CPR), including national identification numbers and addresses of 5.5 million living and 3.3 million deceased individuals. The breach stemmed from weak password security at Pays ApS, an IT company with authorized access to the government database.
The attacker exploited three accounts at Pays, including an administrator account, all secured with the password "123456". The unauthorized access began on September 10 and persisted for 21 days and 17 hours, during which the hacker allegedly used two custom programs to extract and store personal data outside the system. The breach was not a direct attack on the CPR but rather a misuse of legitimate third-party credentials.
Pays, based in Odense, had permission to access the CPR for business purposes, such as verifying customer information. However, the incident highlights third-party cybersecurity risks, as attackers increasingly target authorized vendors rather than breaching central systems directly. The breach also underscores the persistent threat of weak passwords, with "123456" remaining a commonly exploited credential in cyberattacks.
While the attacker claimed the data would not be sold or publicly released, the exposure raises concerns about identity fraud risks and the need for stronger monitoring of bulk data access. Danish authorities and Pays have not confirmed any misuse of the compromised records, but the incident has prompted scrutiny over password policies, third-party oversight, and safeguards for sensitive government databases.
Source: https://beinsure.com/news/denmark-cpr-data-breach-exposes-8-75mn-records/
Westrup ApS cybersecurity rating report: https://www.rankiteo.com/company/westrup-aps
"id": "WES1791845501",
"linkid": "westrup-aps",
"type": "Breach",
"date": "9/2026",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '5.5 million living individuals, '
'3.3 million deceased '
'individuals',
'industry': 'Technology/Third-Party Service Provider',
'location': 'Odense, Denmark',
'name': 'Pays ApS',
'type': 'IT Company'}],
'attack_vector': 'Exploitation of weak passwords (third-party credentials)',
'data_breach': {'data_exfiltration': 'Yes (data stored outside the system)',
'number_of_records_exposed': '8.75 million',
'personally_identifiable_information': 'Yes (national ID '
'numbers, addresses)',
'sensitivity_of_data': 'High (personally identifiable '
'information)',
'type_of_data_compromised': ['National identification numbers',
'Addresses']},
'description': 'A significant cybersecurity incident in Denmark has '
'compromised 8.75 million records from the country’s Central '
'Person Register (CPR), including national identification '
'numbers and addresses of 5.5 million living and 3.3 million '
'deceased individuals. The breach stemmed from weak password '
'security at Pays ApS, an IT company with authorized access to '
'the government database. The attacker exploited three '
'accounts at Pays, including an administrator account, all '
"secured with the password '123456'. The unauthorized access "
'began on September 10 and persisted for 21 days and 17 hours, '
'during which the hacker allegedly used two custom programs to '
'extract and store personal data outside the system.',
'impact': {'brand_reputation_impact': 'Scrutiny over password policies and '
'third-party oversight',
'data_compromised': '8.75 million records (national identification '
'numbers, addresses)',
'identity_theft_risk': 'High (exposure of national ID numbers and '
'addresses)',
'systems_affected': 'Central Person Register (CPR) via third-party '
'access'},
'initial_access_broker': {'data_sold_on_dark_web': 'No (attacker claimed data '
'would not be sold or '
'publicly released)',
'entry_point': 'Exploitation of weak passwords in '
'third-party accounts',
'high_value_targets': 'Administrator account'},
'lessons_learned': 'Highlights third-party cybersecurity risks, persistent '
'threat of weak passwords, and need for stronger '
'monitoring of bulk data access.',
'post_incident_analysis': {'root_causes': 'Weak password security, lack of '
'monitoring for bulk data access'},
'recommendations': 'Implement stronger password policies, enhance third-party '
'oversight, and improve safeguards for sensitive '
'government databases.',
'title': 'Major Danish Data Breach Exposes 8.75 Million Records Due to Weak '
'Passwords',
'type': 'Data Breach',
'vulnerability_exploited': "Weak password security (password: '123456')"}