GoKawiilWeak '123456' password tied to Danish CPR register breach at Pays ApS
Danish newspaper Politiken reported that at least three accounts at Odense-based IT firm Pays, including an administrator account, used the password '123456' when hackers accessed Denmark's CPR civil registration database. The breach reportedly exposed data linked to about 8.8 million CPR numbers, with an anonymous hacker claiming access lasted over 21 days starting 10 September after obtaining a leaked password from a former employee of another small Danish firm.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident highlights how weak credential practices at a single vendor with legitimate database access can expose a national population register, raising questions about oversight of third parties connected to sensitive government systems. A cybersecurity professor's blunt assessment suggests such basic password failures could have been easily prevented, which may prompt scrutiny of authentication standards required for CPR system access.
- Accounts at Pays ApS, including an administrator login, reportedly used the password '123456'.
- The breach exposed data linked to roughly 8.8 million Danish CPR numbers.
- A hacker claims to have had system access for over 21 days starting 10 September, aided by a leaked former employee password.
YubiKey 5C NFC Security Key — This breach happened because weak, guessable passwords like '123456' protected sensitive admin accounts. A hardware security key like the YubiKey adds a physical authentication layer that can't be bypassed by weak or stolen passwords alone, making it a smart upgrade for anyone managing sensitive systems or accounts.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: cphpost.dk, 2026-10-10
Published there as: “`123456' password used in Danish CPR data breach”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.