Denmark Just Proved a Multi-Billion Dollar Cyber Strategy is No Match for ‘123456’

Imagine waking up to discover that your name, physical address, and government identification number have been stolen. Now imagine that the exact same thing happened to literally every single person you know, every person you don't know, and even your deceased relatives.

This isn't a dystopian thought experiment. In October 2026, it became reality for Denmark.

A catastrophic cybersecurity breach exposed the personal data of approximately 8.8 million people — a number that exceeds Denmark's living population because it included deceased individuals and citizens who had moved abroad. The crown jewel of Danish identity, the Central Register of Persons (CPR), had been laid bare.

But the most shocking part of the "Denmark CPR Breach" isn't the scale. It's the punchline: The attacker walked through the front door using the most heavily mocked password in internet history: 123456.

The Third-Party Backdoor: Entering Through the Weakest Link

The Danish state infrastructure itself wasn't directly hacked. Instead, the intruder exploited a classic supply-chain vulnerability: Pays ApS, a tiny, three-person IT and data services company based in Odense, Denmark.

Because of their data-cleansing operations, Pays ApS had legitimate, authorized, and highly privileged access to the state's CPR database. When a business handles national security data, you expect military-grade encryption and multi-factor authentication (MFA).

Instead, investigators found that at least three corporate accounts at Pays ApS — including an administrative account — were secured by the password 123456. There was no MFA. There was no IP-whitelisting. The attacker simply guessed the most common password in the world and was handed the keys to a kingdom of 8.8 million people.

Anatomy of the Attack: The 22-Day Heist

Once inside, the attacker didn't just download a massive file; they blended into the system by masquerading as a legitimate user running routine automated data-cleansing tasks.

• September 10, 2026: The attacker successfully logs into the Pays ApS system using the compromised credentials.
• The Operation: Over the next 10 to 22 days, the intruder launches a massive script that executes roughly 14 million automated searches against the national CPR database.
• October 2, 2026: The breach is finally discovered. Ironically, it wasn't caught by a high-tech cybersecurity alarm. Ministry staff noticed an unusually high invoice generated by the sheer volume of automated searches the vendor's account had suddenly run.
• October 5, 2026: Danish authorities officially confirm the breach to the public.

The Devastating Fallout: The Death of the CPR Number

In Denmark, a CPR number is much more than a social security number. It is deeply integrated into daily life, used to open bank accounts, access healthcare, sign apartment leases, and interface with the government.

Following the breach, the Danish Agency for Public Security (Samsik) dropped a bombshell announcement: A CPR number can no longer be trusted on its own to verify an individual's identity.

The breach has effectively broken the trust mechanism of an entire digital society. Because bad actors now possess a complete map of names, addresses, and corresponding CPR numbers, identity theft, highly targeted phishing, and credential stuffing attacks are expected to skyrocket in the region for years to come.

As for Pays ApS? The company swiftly took its website offline, but the legal, financial, and reputational fallout will likely reverberate across the Nordic tech sector forever.

References:

Denmark data breach: Denmark data breach: Hacker reportedly used '123456' password to access… The data breach was also confirmed by Denmark's Central Population Register (CPR) administration, which maintains the…

Denmark data breach: Weak '123456' password allegedly exposes 8.8 million personal records Denmark's central population database has reportedly suffered a major security breach, with around 8.8 million records…