GoKawiilWeak password '123456' linked to breach of 8.8 million Danish CPR records
A hacker told Danish outlet Politiken that they accessed Denmark's Central Register of Persons by breaching accounts at Pays ApS, a private firm with authorized CPR access, several of which used the password '123456.' The breach exposed names, addresses and ID numbers of 8.8 million living and deceased Danes, and records show the attacker ran roughly 14 million automated searches over about ten days in September before a staffer at another government ministry flagged unusual billing activity.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident shows how a single weak credential at a third-party vendor can expose national-scale personal data, even when the core government register itself wasn't directly compromised. The hacker's claim not to sell or leak the data offers some reassurance, but cannot be verified, and the case highlights gaps in oversight of companies granted privileged access to sensitive government databases.
- A password of '123456' reportedly enabled access to Denmark's CPR database through a third-party firm, Pays ApS.
- 8.8 million people's names, addresses and ID numbers were exposed in the September breach.
- The breach was uncovered not by CPR administrators but by a ministry staffer noticing abnormal search-volume billing.
YubiKey 5C NFC Security Key — This breach happened because weak, reused passwords like '123456' guarded sensitive systems. A hardware security key like the YubiKey adds a physical authentication factor that makes stolen or guessed passwords far less useful to attackers, and it works across major platforms and services. It's a simple step toward the kind of account security this incident shows is badly needed.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: techspot.com — Rob Thubron, 2026-10-14
Published there as: “One of the world's worst passwords, 123456, helped a hacker steal 8.8 million people's data in Denmark”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.