Weak password '123456' used on accounts at firm behind Danish CPR breach, Politiken reports

At least three user accounts at the Funen-based IT company Pays used the password "123456" when hackers gained access to Denmark's CPR register, according to Politiken. One of them was the company's administrator account.

The breach exposed information linked to around 8.8 million CPR numbers. The CPR system is Denmark's central civil registration database. It holds personal information on people who live, or used to live, in Denmark.

Politiken reviewed data from the breach that the hacker allegedly used to get into the system. This is the basis for the report about the passwords. This draft relies on Politiken's account and has not independently confirmed it.

Jens Myrup Pedersen, a professor at Aarhus University's Department of Electrical and Computer Engineering, called the company's password security "hopeless". "There is really no security, it is an open door," he told Politiken. "A password like '123456' is one of the very first things you would guess if you took a list of common passwords." He added: "I find it hard to see that you could have worse security. It was a matter of time before things went wrong."

Pays ApS, based in Odense, confirmed to TV 2 on Friday that it was the company involved. "We can confirm that we are the company that has been subjected to an attack where our legal access to search for information in the CPR system has been abused," managing director and owner Sophie Laursen said in an email to TV 2.

The hacker had access to the CPR register from 10 September for a total of 21 days and 17 hours.

An anonymous hacker told Politiken on Thursday that they were behind the attack. The hacker claimed getting in was not particularly difficult.

According to the hacker, access first came from a leaked password belonging to a former employee of a small Danish company. The hacker then allegedly wrote two computer programs to pull information out of the CPR system and store it elsewhere. The hacker told Politiken there were no plans to sell or publish the data.

Private companies and associations can get access to Denmark's CPR register if they have a legitimate need. One example is looking up address details for customers or members.

According to Denmark's Central Business Register, Pays ApS had two employees as of July 2026.