- An intruder gained unauthorized access to Denmark’s Central Register of Persons (CPR) via a third-party IT vendor.
- The breach occurred because at least three accounts, including an administrative login, were protected by the basic password “123456”.
- Personal records belonging to 8.8 million individuals were exposed; authorities discovered the intrusion only after spotting an unusually high billing invoice.
In one of the most alarming cybersecurity oversights in recent history, Denmark’s Central Register of Persons (CPR)—the core database housing civil identification data for the country’s population—has suffered a monumental compromise. The breach was not facilitated by an advanced persistent threat or zero-day vulnerability, but rather by an unforgivable password failure at an authorized third-party partner.
The Anatomy of the Intrusion: 14 Million Requests in 10 Days
A person claiming responsibility for the compromise contacted Danish newspaper Politiken, stating that access was obtained through legitimate credentials belonging to Pays ApS, an IT firm based in Funen. Pays held authorized integration with the CPR system to supply client identity validation and reference services.
According to the attacker, at least three accounts belonging to the firm—critically including an administrator profile—were protected by nothing more than “123456”. With these credentials in hand, the individual executed automated queries on a massive scale without immediate technical blockage.
| Breach Metric | Details and Figures |
|---|---|
| Records Exposed | 8.8 million people (out of ~11 million total CPR entries) |
| Compromised Data Types | Full names, residential addresses, and personal ID numbers |
| Attack Window | September 10 to September 20 |
| Automated Query Volume | 14 million searches |
| Breach Detection Date | October 2 (12 days after malicious activity stopped) |
| Public Incident Disclosure | October 5 |
How an Invoice Exposed the Breach
According to internal documents obtained by Danish broadcaster TV 2, the threat actor operated inside the CPR database from September 10 until September 20, executing 14 million automated queries. Neither automated defense systems nor the IT firm flagged the anomalous activity while it was actively underway.
The breach was finally uncovered on October 2 by sheer administrative diligence. An employee at the Ministry of Higher Education and Science noticed an unexpectedly high billing invoice tied to abnormally heavy query volumes generated by Pays ApS. Following internal confirmation, Denmark’s data protection agency, Datatilsynet, was notified on October 4, and the government officially confirmed the security incident on October 5.
Corporate Accountability and Repercussions
Managing director Sophie Laursen confirmed on October 9 that Pays ApS’s authorized credentials had indeed been abused to harvest national data. In the wake of the revelation, the firm’s website was pulled offline, and company leadership has refrained from answering press questions regarding credential management standards.
While the self-identified hacker maintains they have no intention of publishing or monetizing the exfiltrated records, the exposure of 8.8 million profiles—encompassing living citizens, deceased individuals, and expatriates—presents severe long-term identity theft risks across the kingdom.
This incident underlines the critical importance of supply chain security. Government repositories containing sensitive national databases cannot rely solely on perimeter controls; they must mandate strict credential hygiene, mandatory multi-factor authentication (MFA), and automated rate-limiting across all integrated third-party enterprise accounts.
Blaming a weak password misses the deeper architectural failure here. Why did an external partner have unthrottled API access to run 14 million queries without triggering automated rate limits? Vendor management and monitoring are notoriously difficult to enforce, but basic anomaly detection should not rely on an unexpected billing invoice.