Blog

According to the Danish newspaper Politiken, at least three user accounts of the Danish IT company Pays used the password “123456” at the time a hacker gained access to the Danish Civil Registration System (CPR). One of these accounts was the company’s administrator account. The incident demonstrates how a weak basic security measure can have significant consequences.

The data breach exposed information associated with approximately 8.8 million CPR numbers. The CPR register is Denmark’s central population registry and contains personal data of individuals residing in Denmark or previously registered there. Politiken states it has reviewed data from the breach that the hacker claims to have used to gain entry.

Pays ApS, based in Odense on the island of Funen, confirmed to TV 2 on Friday that it is the affected company. Sophie Laursen, owner and director of Pays, stated in an email that the company was attacked and that its legal access to look up data in the CPR system was exploited. According to the Danish business register, Pays had two employees in July 2026. Thus, a small company was granted access to a highly sensitive registry.

Starting from September 10, the hacker had access to the registry for a total of 21 days and 17 hours. This is a period of over three weeks during which data could be retrieved. For your organisation, this is a reason to assess whether unusual access to sensitive systems is detected quickly enough.

An anonymous hacker told Politiken they were behind the attack and claimed that gaining entry was not particularly difficult. According to this individual, access was initially established using a leaked password from a former employee of a small Danish company.

Subsequently, the hacker reportedly created two computer programs to retrieve data from the CPR system and store it externally. The hacker claims to have no intention of selling or disclosing the data. These are the hacker’s own assertions.

Read the dutchitleaders.nl article for more information.