Password 123456 reportedly exposed the data of 8.8 million Danes
Through a Danish company’s access, someone obtained the data of 8.8 million people from Denmark’s population register. According to the attacker’s account in the newspaper Politiken, the password was 123456.
What happened
Someone has pulled the names, addresses and personal ID numbers of some 8.8 million people out of Denmark’s population register. The register itself did not have to be cracked: the attacker used the access of a small Danish company that was allowed to search it.
Denmark’s Ministry of Research, Higher Education and Digitalisation disclosed the breach on 5 October. The register, the CPR, holds some 11 million people, including Danes who have died or emigrated, which is why the number exceeds the population. People with a protected address were not affected. The attack ran through September and the CPR office only noticed it on the evening of Friday 2 October, according to Danish media because of an unusually high bill for a small company. Documents obtained by the broadcaster TV 2 show some 14 million automated searches in ten days. The Danish data protection authority speaks of a form of brute force: the attacker tried out numbers and pulled the data for every valid one.
The company has been cut off, the police are investigating and the minister, Christina Egelund, has ordered a security review of the entire register. She called it a deeply serious incident. Citizens were told to be wary of calls and emails from people who already seem to know their details.
On 8 October the newspaper Politiken carried the account of someone who claims to be behind the attack. They say they got in on 11 September with the leaked password of a former employee of the company: 123456. According to Politiken, at least three accounts at the company, one of them an admin account, used that password. The attacker says they will not sell or leak the data, and shared a file of the numbers with the paper. Security researcher Emil Hørning finds the account credible; the authorities have not confirmed the password. Minister Egelund did admit that security around the register was not good enough.
Never give out a password or other confidential information, even if someone already knows your name, address and CPR number.
The Danish government’s advice to citizens, 5 October 2026, in short
The background
Why the number is no secret
Denmark has had the CPR since 1968. Everyone registered in it gets a ten-digit number: first the date of birth, then four digits, the last of which is even for women and odd for men. The number runs through just about everything, from healthcare and tax to banking.
Precisely because the number starts with your date of birth, it can be guessed. That fits the ratio in this breach: of the more than 14 million searches, some 8.8 million returned a person. The Danish security specialist Jan Kaastrup therefore calls treating the number as a secret a broken approach: a number on its own should never prove who you are. The authorities now advise organisations not to identify customers by their CPR number alone, but with MitID, Denmark’s digital identity, or a one-time code.
How companies get into the register
Under Danish law, companies with a legitimate interest may request data from the CPR, for example to keep the addresses of customers or members up to date. That access is meant for a group of people defined in advance, each identified individually. Companies pay for what they request, which is how the breach eventually came to light. How one small company could search millions of times without any brake has not yet been explained by the authorities.
A supplier was the way in before
What the prosecutor called the biggest hacking case in Danish history also turned on an outsider with access. In 2012 Gottfrid Svartholm Warg, co-founder of The Pirate Bay, and a Danish accomplice broke into the IT company CSC, which ran government registers. They reached the driving licence register, the CPR and the Schengen countries’ wanted-persons register, using police officers’ login details. In 2014 Svartholm Warg was sentenced to three and a half years in prison.
Our analysis
The story is the missing brake, not the password
The password 123456 makes a catchy headline, but it comes from the attacker’s own account. What is confirmed is more instructive. One small company, whose access was meant for a set group of customers, could search more than 14 million times in ten days, and nobody noticed until the bill arrived. Even with a strong password, a stolen login would have had the same reach.
That is the pattern with supplier access. Organisations check who gets access, but rarely how much that access is used. A cap per customer and an alert on unusual volumes would have stopped this attack on day one, whatever the password. And a second sign-in step, such as a code on a phone, would have made a leaked password worthless. If the attacker’s account is true, the login of someone who had already left still worked, too. That is a lesson in itself.
For the 8.8 million people in the file, the risk is only beginning: a fraudster who knows your name, address and number sounds convincing. Our expectation: more registers and platforms will put a cap and an alert on every account. If you share sensitive data through an integration yourself, it pays to start now.
What stands out
- The bill brought it to light According to Danish media, the CPR office only spotted the breach because of an unusually high invoice for a small company, not through a security alert.
- Sixteen lookups a second went unnoticed Some 14 million automated searches in ten days works out at more than sixteen a second on average. No alarm went off.
- The number can be guessed A CPR number is your date of birth plus four digits. Of the more than 14 million searches, about 8.8 million hit.
- The password comes from the attacker The password 123456 and the former employee come from the attacker’s account. A researcher finds it credible; the authorities have not confirmed it.
What it means for you
Every supplier that can reach your data is also a way in for whoever takes over its access.
- Someone else’s access is your risk too The attacker did not need to break into the register. The login of a company that was allowed to look was enough.
- One weak password can be enough If the attacker’s account is true, a trivial password opened the door. Ask your suppliers whether they sign in with a second step, such as a code on their phone.
- Watch what gets pulled out The attack went on for weeks before anyone noticed. Keep an eye on how much data an account retrieves; an unusual amount is a reason to raise the alarm.
Where we come in · Support
We keep track of who can reach what
With Support we keep checking who has access to what your colleagues build with AI: accounts, keys and external services. Every point that needs attention becomes a task with an owner, so nothing is left lying around.
Do you know which suppliers can reach your data?
Tell us how it is set up at your organisation. We’ll look at it with you and always reply within one working day.
