GoKawiilWeak '123456' password at Pays ApS exposed 8.8 million Danish CPR records
A hacker claims they breached Denmark's Central Register of Persons by exploiting a Pays ApS account secured only with the password '123456'. The Danish government confirmed 8.8 million records were extracted, discovering the breach 12 days later via an unusual invoice, and Pays ApS's managing director Sophie Laursen confirmed the access point. The hacker says they do not intend to sell or leak the data.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident highlights how third-party vendor access can undermine even sensitive government databases, since a single weak credential reportedly exposed records on nearly all Danish citizens. It also echoes other recent government data failures, such as Indonesia's unbacked-up systems hit by ransomware and South Korea's data center fire, suggesting a broader pattern of inadequate safeguards around public records. This could prompt Denmark and other governments to reassess password and authentication requirements for contractors with database access.
- A hacker claims to have breached Denmark's CPR database via a '123456'-protected account at Pays ApS.
- 8.8 million records were taken; the breach was detected 12 days later through unusual invoicing activity.
- The case underscores vendor security risks and may prompt reviews of authentication standards for government data access.
YubiKey 5 NFC Security Key — This breach happened because a single weak password protected access to millions of sensitive records—exactly the failure hardware security keys are designed to prevent. A YubiKey adds a physical authentication factor so stolen or guessed passwords alone can't grant access to critical systems. It's a simple, effective upgrade for anyone managing sensitive accounts, personal or professional.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: tomshardware.com — Jowi Morales, 2026-10-13
Published there as: “Hacker claims ‘123456’ password let them breach the Danish national registry, accessing 8.8 million records”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.