The breach came to light after investigators found that a small IT company, Pays ApS, based in Odense, Denmark, had allowed hackers to access the nation’s Central Person Register (CPR) using extremely weak credentials. According to the Copenhagen Post, at least three user accounts at Pays ApS – including the administrator account – were protected only by the password '123456' when the intrusion occurred. The company confirmed to TV 2 that its legitimate access to the CPR system had been abused in the attack.
Once inside, the attackers reportedly extracted personal data linked to around 8.8 million CPR numbers, which cover names, addresses and registration numbers for people living or previously registered in Denmark. The unauthorized access began on 10 September and persisted for a total of 21 days and 17 hours before being stopped on 2 October. The hacker told Politiken that the initial foothold came from a leaked password belonging to a former employee of another small Danish firm, after which they built two custom programs to harvest CPR data and store it externally.
Security expert Jens Myrup Pedersen of Aarhus University denounced the password protection as 'hopeless,' saying a guess like '123456' is among the first tried in any attack. Despite the scale of the exposure, the hacker claimed there were no plans to sell or publish the stolen information. Pays ApS, which employed only two staff members as of July 2026 according to Denmark’s Central Business Register, has since been identified as the source of the breach, prompting the Ministry of Research, Education and Digitalization to order a security review of the CPR register.