9 Million Records Leaked Due to Simple Password Vulnerability

Ender Öztürk

October 15, 2026

A severe cybersecurity breach has compromised the sensitive personal data of approximately 8.8 million individuals within the Danish Civil Registration System (CPR). The incident, which came to light recently, was facilitated through a third-party service provider, Pays ApS, that maintained legitimate access to the government database. Security analysts confirmed that an unauthorized actor gained entry by utilizing the credentials of a former employee, relying on the remarkably insecure password “123456.” This significant data leak exposes critical information, including names, residential addresses, and unique 10-digit registration numbers, highlighting major vulnerabilities in state-managed digital infrastructure and third-party access protocols.

Weak Access Protocols Facilitate Massive Data Breach

The incident serves as a stark reminder of the dangers associated with supply chain vulnerabilities in government systems. Pays ApS, a company authorized to interface with the CPR database, became the focal point of the investigation after it was discovered that its system provided the gateway for the unauthorized entry. The attacker, who reportedly claimed to have no malicious intent to sell or distribute the sensitive data, stated that the same rudimentary password was being used across three distinct accounts, allowing for unfettered access to highly confidential national records.

The breach was not instantaneous but rather the result of a sustained effort. According to reports from the Danish media outlet TV 2, the perpetrator conducted approximately 14 million automated queries within a ten-day window. The anomaly was eventually flagged by a government employee who noticed irregular patterns in the server logs linked to the third-party company. This discovery led to the immediate suspension of the company’s access and the temporary shutdown of their web portal.

Security Experts Analyze the Severity of the Incident

Independent cybersecurity researcher Emil Hørning has reviewed the attacker’s methods and verified that the breach was both plausible and technically straightforward. In an attempt to prove the validity of their claims, the perpetrator provided a sample of the stolen data to the newspaper Politiken, which corroborated the scope of the exposure. The attacker famously compared the ease of the breach to finding a suitcase filled with radioactive material left unattended at a train station, emphasizing the systemic negligence involved.

The exposed data includes the 10-digit CPR numbers that are essential for navigating daily life in Denmark, including interactions with banking, taxation, and healthcare institutions. The potential for these records to be utilized in sophisticated identity theft or targeted phishing campaigns remains a primary concern for privacy advocates and government officials alike.

Authorities Are Strengthening Data Protection Measures

In response to the crisis, the CPR administration has initiated a comprehensive investigation and is currently in the process of upgrading its security infrastructure. The incident has prompted a nationwide debate regarding the oversight of external contractors. Experts are now calling for mandatory multi-factor authentication and stricter lifecycle management for employee credentials, particularly when third-party access is involved.

The failure to deactivate accounts belonging to former employees or to enforce complex password policies represents a significant breach of duty that has now affected millions of citizens. As the investigation continues, the government must demonstrate how it plans to prevent such elementary security lapses in the future.

Given the high stakes involved in handling sensitive personal information, do you believe governments are doing enough to audit the security practices of the private companies they partner with? Share your thoughts on the matter in the comments section below.