Hacker breaches Denmark’s population registry with '123456' password via third-party company

How the breach happened

According to TechRadar, a hacker gained access to Denmark’s national population registry, the Danish Central Register of Persons (CPR), by exploiting weak credentials at a third-party company, Pays ApS. The company had legal access to the CPR system, which the attacker abused to run 14 million automated searches over ten days.

The hacker reportedly used the password '123456' to access the system, a flaw described as the only barrier between the attacker and the sensitive data.

Three separate accounts at Pays ApS were found using the same weak password, highlighting a systemic failure in basic security practices.

Scope of the exposed data

The breach exposed data on approximately 8.8 million individuals, including CPR identification numbers. The CPR system holds around 11 million records in total, covering not only current residents but also deceased individuals and those living abroad.

While the attacker claimed no intention of leaking or selling the stolen data, the incident raises serious concerns about the potential for identity theft, phishing, and other forms of cybercrime.

TechRadar reported that the attacker’s methods and account appeared credible, suggesting the breach was not a hoax.

Response and implications

The breach has drawn attention to the risks of third-party access to critical systems. Pays ApS, a company based in Funen, Denmark, was the weak link in this incident, demonstrating how easily supply chain vulnerabilities can compromise national infrastructure.

For operators and founders, this incident serves as a cautionary tale about the importance of enforcing strong security protocols, even for trusted partners. Simple measures like multi-factor authentication and regular security audits could have prevented this breach.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This breach is a stark reminder of how third-party vulnerabilities can expose even the most sensitive national systems. For founders and operators, it underscores the importance of enforcing strict password policies, multi-factor authentication, and continuous monitoring of third-party access. The fact that a simple password like '123456' could grant access to a national registry is indefensible and reflects a failure in basic security hygiene. Startups and businesses handling sensitive data must prioritize security audits, especially when granting access to external partners. The reputational and operational risks of such oversights are too high to ignore.

Key takeaways

• Third-party access can be a critical weak point in even the most secure systems—audit and monitor all external permissions.
• Weak passwords and lack of multi-factor authentication create easily exploitable vulnerabilities.
• Automated security checks and anomaly detection are essential to prevent large-scale data abuses.
• Founders must prioritize security hygiene as a non-negotiable part of their operations, not an afterthought.
• The scale of this breach shows how quickly a single oversight can impact millions of people.

FAQ

What is the Danish Central Register of Persons (CPR)?

The CPR is Denmark’s national population registry, containing sensitive identification numbers and personal data for residents, deceased individuals, and those living abroad. It holds approximately 11 million records.

How did the hacker access the CPR system?

The hacker exploited weak credentials ('123456') at a third-party company, Pays ApS, which had legal access to the CPR system. The attacker used this access to run 14 million automated searches over ten days.

What data was exposed in the breach?

The breach exposed data on approximately 8.8 million individuals, including CPR identification numbers, which are sensitive and can be used for identity theft or other cybercrimes.

Has the stolen data been leaked or sold?

According to reports, the attacker claimed no intention of leaking or selling the stolen data. However, the risk of future misuse remains a concern.

Related on Lazyfounder

• More technology news
• EU data centers refuse to disclose energy and water usage, investigation finds