Weak '123456' Password Exposed Data on 8.8 Million People

TechRadar reports that an attacker accessed data held by Denmark’s Central Register of Persons (CPR) after allegedly using a former employee’s password, “123456.” The outlet says the incident, in September 2026, involved information on 8.8 million people.

CPR said someone gained unauthorized access by abusing a Danish company’s legitimate access to search the registry. Private companies can access information about limited groups of people they have identified in advance. CPR did not initially name the attacker or company, and said its investigation was ongoing while it took steps to strengthen security.

Danish media later identified the company as Pays ApS, based on reporting confirmed by its managing director, Sophie Laursen. TV 2 reported that the attacker ran 14 million automated searches over ten days. The activity was noticed after a government employee saw an unusually high number of searches in Pays’ activity log. Pays’ website was temporarily taken offline and was operating normally at the time of TechRadar’s report.

Politiken reported speaking with the unnamed attacker, who said they used a former employee’s login credentials and created two scripts to transfer CPR information to a third-party system. The attacker said three accounts used the same password and claimed they did not intend to leak or sell the data. Cybersecurity researcher Emil Hørning told the publication the account appeared credible and the described methods were plausible. TechRadar says CPR holds about 11 million records, including records for deceased people and people living abroad.