INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Denmark data breach linked to compromised '123456' password

| 2026-10-13 11:14 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
A data breach occurred in Denmark on October 5, affecting approximately 8.8 million people's information stored in the Central Register of Persons (CPR). The breach was attributed to a Danish company, Pays ApS, whose access to the CPR system was abused by exploiting an IT company account protected by the weak password "123456". According to reports, at least three company accounts used this password. The attacker gained unauthorized access between September 10 and September 20, running 14 million automated searches before being detected on October 2, 12 days later. Denmark's CPR administration confirmed the breach, while Pays ApS' managing director Sophie Laursen acknowledged that her company's access had been exploited.
Technical Mitigations AI-generated
• Use a stronger password than "123456" to protect company accounts. • Monitor for unusual activity on invoices and report it promptly, as indicated by the department staffer who discovered the attack. • Implement automated search logs to detect potential security breaches in real-time.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORDICS NORDICS mediamedia
Incident Timeline
‎September 10
Threat actors used automated searches to gain access to Denmark's CPR system starting on September 10.
general_metric 2 broadcaster TV
According to documents obtained by broadcaster TV 2 , the attacker gained access to the CPR system on September 10 and ran the 14 million automated searches between then and September 20.
general_metric 14 automated searches
According to documents obtained by broadcaster TV 2 , the attacker gained access to the CPR system on September 10 and ran the 14 million automated searches between then and September 20.
‎between then and September 20
Threat actors used automated searches to target the CPR system of Denmark between September 10 and September 20.
general_metric 2 broadcaster TV
According to documents obtained by broadcaster TV 2 , the attacker gained access to the CPR system on September 10 and ran the 14 million automated searches between then and September 20.
general_metric 14 automated searches
According to documents obtained by broadcaster TV 2 , the attacker gained access to the CPR system on September 10 and ran the 14 million automated searches between then and September 20.
‎October 2
Threat actors used the '123456' password to target Denmark's data breach, which was detected 12 days after the last reported searches on October 2.
‎October 4
Datatilsynet was notified on October 4 about a Denmark data breach affecting approximately 8.8 million people, linked to the '123456' password used by an attacker.
target_region Denmark
The Danish data protection authority, Datatilsynet, was notified on October 4, and the government disclosed the attack the following day.
organisation Datatilsynet
The Danish data protection authority, Datatilsynet, was notified on October 4, and the government disclosed the attack the following day.
‎October 5
Threat actors exploited a Danish company's legal access to the CPR system, resulting in a breach affecting 8.8 million people's information on October 5.
general_metric 8.8 people
Denmark's CPR administration confirmed a breach affecting the information belonging to 8.8 million people on October 5, adding that a Danish company's legal access to the CPR system was abused.
target_region Denmark
Denmark's CPR administration confirmed a breach affecting the information belonging to 8.8 million people on October 5, adding that a Danish company's legal access to the CPR system was abused.
‎October 9
Pays ApS's access was exploited on October 9.
organisation Funen
It did not name Funen-based Pays ApS as the company in question, but managing director Sophie Laursen confirmed on October 9 that it's access had been exploited.
organisation Pays ApS
It did not name Funen-based Pays ApS as the company in question, but managing director Sophie Laursen confirmed on October 9 that it's access had been exploited.
‎2026/10/13
A person claiming responsibility for the breach of Denmark's Central Register of Persons accessed information relating to 8.8 million people using a weakly protected account at an IT company.
organisation Central Register of Persons
security '123456' password linked to Denmark data breach affecting 8.8M people Local media reports three weakly protected accounts at small IT biz whose access to national register was abused A person claiming responsibility for the breach of Denmark's Central Register of Persons (CPR) says they gained access through an IT company's account protec…
organisation CPR
security '123456' password linked to Denmark data breach affecting 8.8M people Local media reports three weakly protected accounts at small IT biz whose access to national register was abused A person claiming responsibility for the breach of Denmark's Central Register of Persons (CPR) says they gained access through an IT company's account protec…
organisation Register
Pays' website has been taken offline, and the business has not responded to The Register's request for more information about the password claims.
data_breach 11 records
The register contains approximately 11 million records, including those of deceased people and people who have moved abroad.
‎2026/10/25
Threat actors used a linked '123456' password to target Denmark's data breach, which occurred 12 days after the last reported searches.
Tactical Metrics
Metrics
data_breach
11,000,000
Records
The register contains approximately 11 million records, including those of deceased people and people who have moved abroad.
Intelligence Sources
The Register - CSO 2026-10-13