Denmark CPR Breach Took 8.7 Million ID Numbers Through a Two Person Company and the Password 123456

8,749,975 Danish ID numbers copied in about ten days. Names and home addresses, the dead included. One company with two employees. Its admin password: 123456. Found only when the invoice came.

The copied data holds names, home addresses and CPR numbers. The CPR number is the personal ID number Danes get at birth, or when they move to the country, and usually keep it for life. People who have died are in the data too, and so are people who moved abroad years ago. Denmark has about 6 million inhabitants. The register behind those numbers holds about 11 million records, and roughly 8.8 million of them were pulled out, according to the Danish digitalisation ministry.

The company the data went through is Pays ApS, a small software firm in Odense. In July 2026 it had two employees, according to the Danish business register. One of its services is what Danes call cpr-vask: cleaning up customer files against the national register, so that names and addresses are up to date.

For that work, the company had legal access to the register. Section 38 of the Danish CPR Act lets private companies look people up when they have a business reason, for example to find the current address of a customer or a member. The law asks the company to have identified each person individually beforehand, by CPR number or by name and address. Banks, telecom companies, insurers, law firms and trade unions have this kind of access. In total, 1,039 organisations do.

The story of how someone else got in comes from a person who says they did it. On Thursday evening, October 8, the Danish newspaper Politiken published its interview with the hacker. The paper spoke to them in English through an encrypted service, and received a file with 8,749,975 CPR records.

Its reporters put a description of the data and the method to several experts, and they all found it very likely that this person took part in the leak. One of them, Emil Hørning of the security company Defend Denmark, called the account credible and the method plausible.

The way in, according to the hacker, was the password of a former employee. That password had leaked earlier, and it was 123456.

The newspaper then did its own checking, and found at least three profiles at the company that used 123456. One of them was the administrator account, the account that can manage the others.

The company’s director and owner confirmed that its legal access to the CPR system had been abused. She declined an interview through her lawyer, and did not answer the newspaper’s questions about the company’s security.

Each lookup in the register costs money, and the CPR office bills the companies for them. On Friday evening, October 2, staff were preparing the invoice for this company. They saw an amount that a department head at the ministry later described at a press briefing as very, very large. Behind it were more than 14 million lookup attempts, made over about ten days in September. The company told the CPR office it had not made those lookups itself.

Documents seen by the Danish broadcaster TV 2 show that the access was in use from September 10. It stayed open for 21 days and 17 hours. The lookups appear to have stopped around September 20. By the time the invoice showed what had happened, whoever made them had been gone for twelve days. Jens Myrup Pedersen, a cybersecurity professor at Aarhus University, said the attacker got what they wanted and then left on their own. He also pointed out that there was no working system to spot the unusual activity.

The register itself is run by DXC Technology, a US company the Danish state hired to operate the CPR register and handle its IT security. The broadcaster has tried to get an answer from the company since October 6, and it has not replied.

14 million attempts against a register of about 11 million records. The ministry’s 8.8 million is the number of lookups that came back with a person. The broadcaster explained the gap: you can also search for numbers that do not exist.

That gap makes sense once you know how a CPR number is built. It has ten digits. The first six are the birth date: day, month, and the last two digits of the year. The seventh digit, read together with the year, tells which century the person was born in. The tenth digit is even for women and odd for men. Statistics Denmark describes the structure in its own documentation of the register.

A person born on 4 March 1985 has a number that starts with 040385. Four more digits follow. For one birth date, that leaves at most 10,000 possible numbers, and many of them were never given to a person. Numbers like that return nothing, which is how a search ends up with more attempts than there are records.

A program that wants most of the register can start from a date instead of a list of names. It tries the possible numbers for that date, keeps the ones that return a person, and moves on to the next day.

In its notice of October 5, the Danish Data Protection Agency writes that the register reported a very large number of automatic lookups, made to find out which CPR numbers are valid. The police have not described the method yet. One detail the hacker gave fits that description too.

AI wrote the program, the hacker told the newspaper. It is more than 40,000 characters long, and two experts who looked at the code for the paper concluded that it was indeed AI-generated. According to the hacker, any AI model launched in the past year could have done it. The hacker denied having strong technical skills.

As an example, the hacker pointed to a bug. The program searched for people born in 1877 instead of 1977, and because of that, people born in 1977 are missing from the file the hacker shared. In a CPR number, 1877 and 1977 have the same first six digits for the same birthday. Only the seventh digit sets the century apart. A program that got the century wrong for one year skipped the Danes born in 1977 who were in the register.

You can change a leaked password in a minute. A CPR number stays. The same documentation says a number is never handed out a second time. Getting a new one is rare. It happens, for example, when the birth date or sex was registered wrong, or after a legal change of gender.

The minister for digitalisation, Christina Egelund, called the breach deeply serious and said it was too early to say whether people will get new numbers. Prime Minister Mette Frederiksen said it was an incident that should not have been possible.

Danes use the CPR number for public services, healthcare, tax and banking. Companies accepted it as a sign that the person on the other side was who they said they were. Laila Reenberg of Styrelsen for Samfundssikkerhed, the Danish agency for societal security, said you cannot use the number on its own to authorise anything, buy something or get sensitive personal information. She told companies and authorities to stop accepting a CPR number on its own as proof of who someone is.

What the copied data does give a criminal is a convincing start. A phone call or an email from someone who already knows your full name, your address and your ID number sounds like your bank or the tax office. The ministry warned about exactly that on the day it announced the breach. Never give out passwords or other confidential information by phone or email, it said, also when the person seems to know your name, address and CPR number.

Danes took that warning seriously. On October 5, the day the breach was announced, about 1,000 people called the national cyber hotline, against about 150 on a normal day. The government advice site sikkerdigital.dk had 180,000 visits against about 400. A credit warning is a flag that tells lenders to check extra carefully before they give credit in your name. The number of people who had one went from a little under 250,000 on October 1 to about 970,000 on October 7.

On Friday October 9, the CPR office sent a letter to the 1,039 organisations with access. It repeated the security rules they already had to follow. Each needs someone responsible for security and has to check regularly which employees still have access. It also has to keep an eye on how many lookups it makes each month.

Taking that access away is not simple either. The Confederation of Danish Industry, DI, warned that limiting what companies can look up in the register could make their work more expensive and lead to more mistakes. They would have to collect and check the data by hand.

The CPR office has cut off the company’s access and reported the breach to the data protection agency. Officers from the National Unit for Special Crime went to the company on Saturday October 3 to secure evidence, and they are in contact with police abroad. So far there are no charges.

The names and addresses of people with name and address protection are not in the data. MitID, the login Danes use for banks and government services, was not part of this breach. The minister has ordered a full security review of the CPR system.

The hacker told the newspaper that the data will not be sold or published. That is a promise from the person who took it, and nothing more.

123456 keeps showing up. In June I wrote about FortiBleed, where the exact same admin3 account with the password 123456 sat on 2,645 Fortinet firewalls. Pwned Passwords, the list of breached passwords run by Have I Been Pwned, has seen 123456 210,461,208 times.

NIST, the US standards body, tells systems that accept passwords to check each new one against a list of passwords that are common, easy to guess or already leaked. That list is called a blocklist, and the rule is in section 3.1.1.2 of its guideline SP 800-63B-4. A company with access to the register that holds the ID numbers of most of a country had at least three accounts on one of the most common passwords there is.

You can check your own passwords against that same list without sending them anywhere. On Linux, this asks for the password without showing it and turns it into a fixed string of characters that you cannot turn back into the password, a SHA-1 hash. Only the first five characters of that hash go to the service:

1
2
3

printf 'Password: '; read -rs pw; echo
hash=$(printf '%s' "$pw" | sha1sum | awk '{print toupper($1)}'); unset pw
curl -s "https://api.pwnedpasswords.com/range/${hash:0:5}" | grep "${hash:5}"

The service sends back the hashes that start with those five characters, and grep looks for yours on your own machine. For 123456 the answer is:

1

D09CA3762AF61E59520943DC26494F8941B:210461208

The number after the colon is how often that password was seen in breaches. No output means it is not in the list.

What you can do:

• → Check the passwords you use against that list, with the command above or at haveibeenpwned.com/Passwords
• → Use a password manager, so each account gets its own long password and one leak stays at one company
• → Turn on two-step login wherever it is offered, and on admin accounts first
• → If you run a business, close the accounts of former employees on the day they leave
• → Treat a caller who knows your name, address and ID number like a caller who knows nothing: hang up and call the bank or office back on a number you look up yourself
• → If your service is billed per use, look at the invoice; here it was the only alarm

Want to see how fast a password like 123456 falls? Build your own lab and run a dictionary attack with the RockYou wordlist against it. My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

Danish Ministry of Research, Education and Digitalisation | Datatilsynet | Statistics Denmark, CPR number