The Password Was 123456: Denmark’s Population Register and Pays ApS

On the evening of Friday, October 2, 2026, someone inside the administration of Denmark’s Central Person Register noticed that the register was behaving strangely.

Not the country. The register. The CPR is the file Denmark has kept since 1968 on everyone who lives or has lived there: the living, the emigrated, the dead. It holds on the order of 11 million records in a country whose population, at the start of 2025, was just under 6 million. It is not a marketing database. It is the spine that other Danish systems hang identity on. A CPR number is ten digits — six for the date of birth, four serial digits, the last even for women and odd for men — and for most of a lifetime it is the number you are asked for when the state, a bank, a doctor, or a landlord wants to know which person you are.

Over that weekend the administration learned the scale. On October 5, the Ministry for Research, Education and Digitalisation said it in the plainest language a ministry can use. Unauthorized parties had abused a Danish company’s lawful right to search the CPR. They had obtained names, addresses, CPR numbers, and more on about 8.8 million registered people. Four in five rows in the national book.

The phones of the state had not rung in time. An employee had. And, as DR would report from the October 6 briefing, the hint that something was wrong was not a systematic alarm. It was an expensive invoice.

A Lawful Door, Used Unlawfully

This is the fact that makes the case different from a smashed server. The company was allowed to be there.

Under the CPR Act, a private company with a legitimate interest can receive register data on people it has already identified, one by one — by CPR number, by date of birth and name, or by name and address. The data a company may receive includes a current name and address, unless the person has name-and-address protection, and facts such as a death, a move abroad, or a credit warning. The ministry was careful on this point. The unauthorized access stayed inside the classes of data private companies are permitted to receive. It did not include the names and addresses of people registered with name-and-address protection. That is a real limit. It is not a comforting one. The ministry’s statement did not say those people’s CPR numbers were spared, and it did not say anyone would be told, individually, that they were among the 8.8 million.

The company was Pays ApS, of Odense. It confirmed as much to TV 2 on October 9: it was the firm whose legal access to search the CPR had been abused. Denmark’s Central Business Register, as relayed in the October 10 reporting, listed it with two employees as of July 2026. Two people. A lawful key to a register of eleven million. This is the modern shape of a national breach. The state does not hand the database to the attacker. It hands a lookup right to a vendor, and the vendor’s login becomes the state’s login.

Christina Egelund, the minister responsible for digitalisation, told Ritzau that the safeguards around this company’s access had not been good enough, and that red lights should have come on given how long the access ran. She asked for a full security review. She would not say, in those first days, whether investigators saw criminal intent inside the company itself. The police went to the smaller firm in person to collect traces. Foreign police were contacted in case the operators were not in Denmark. No public attribution followed.

Twenty-One Days, Seventeen Hours

The duration is disputed in a way that matters.

Egelund’s first public description put the access at about ten days in September. Ritzau later reported a harder number: access from September 10 for 21 days and 17 hours. Either figure is an indictment. A lookup right used to walk a national register for two or three weeks is not a mistyped query. It is a job.

Datatilsynet, the Danish data protection authority, received the register’s notification on Sunday, October 4. The notification, the authority said, described a very large number of automated lookups against the CPR, made in order to identify valid CPR numbers. The authority had not yet assessed the case. It described the numbers as allegedly retrieved. The fact pattern does not need the authority’s final word to be legible. Someone was not looking up customers they already had. Someone was enumerating the register, asking it which numbers were real.

A CPR number’s format makes that kind of guessing thinkable. Six digits of birth date, four serial digits: at most ten thousand candidates for a given birthday. The Hacker News, doing the arithmetic in public, noted that neither Datatilsynet nor the ministry had said whether the lookups walked those possibilities. The police, at the October 6 briefing, said they were looking at whether an algorithm had been used, as a hypothesis, because so many lookups happened in so little time. They would not say more. They also said it was not yet clear who was behind it, how the access was first obtained, or — in those first hours — whose access had been misused.

The invoice is the detail that should embarrass every registry operator who has ever trusted a vendor portal. DR reported that it was a costly bill, not a standing alarm, that hinted a breach had happened. The register knew how to charge for lookups. It did not know how to shout when the lookups stopped looking like a two-person company’s ordinary business. An employee of the CPR administration noticed irregular behavior on the evening of October 2. The minister agreed the alarms should have fired earlier. Agreement after the fact is not a control.

The Password

On October 10, the Copenhagen Post, carrying Ritzau, reported what Politiken had found in data tied to the breach. At least three accounts at Pays used the password 123456. One of them was an administrator account. An Aarhus University professor, quoted in that reporting, called the company’s password security hopeless. That is not a colorful aside. It is the whole failure in one string.

123456 is not an obscure default. It is the password the industry has been publishing at the top of every annual list for as long as those lists have existed. It is the password that means nobody was required to choose another one, and nobody was watching to see that they had. On an administrator account that can reach a national population register, it is not a mistake at the edge of the system. It is the system.

An anonymous person told Politiken they were behind the attack, and that access began with a leaked password of a former employee of a small Danish company. They said they then built two programs: one to pull information from the CPR, one to store it outside. The article did not establish that the former employee worked at Pays. Experts Politiken interviewed considered it likely the claimant had been involved. It remains a claim. The password finding does not. Politiken reviewed data. Three accounts. Including the administrator. 123456.

Treat the claimant’s story as a story until a prosecutor says otherwise. Treat the password as the fact that made the story plausible. A leaked credential is only as powerful as the door it still opens, and as the other doors that use the same secret. A former employee’s password should have been dead. An administrator password should not have been a joke. Automated lookups in the tens or hundreds of thousands should have been a page on someone’s screen in week one, not a line on an invoice in week three.

What a CPR Number Is, Once It Is No Longer Secret

The ministry’s public advice was the advice of a state that knows the number has already left. Do not give passwords or other confidential information to anyone who calls or emails, even if they know your name, your address, and your CPR number. Do not click unexpected links. Go to the official site yourself, or call back on the main number. Never share MitID details, one-time codes, passwords, or card numbers. Set a credit warning on borger.dk — a marker, available from age fifteen, that tells lenders to be careful before extending credit in your name. It registers at once and can take days to reach the companies that choose to read it. It is a signal, not a lock.

The Cyberhotline, +45 33 37 00 37, extended its hours to midnight in the days after the announcement. That is what a national identity breach looks like in practice: a phone line, longer shifts, and a public plea not to believe a stranger who knows you.

The director of the agency for societal security, Styrelsen for Samfundssikkerhed, said at the October 6 briefing that a CPR number can no longer be used to authenticate a person. The register’s own guidance already said a CPR number must not be the only proof of identity. The breach turned that guidance into an order. Knowledge of the number is now ambient. Anyone who treats it as a secret is treating a published fact as a key.

Egelund told Ritzau it was too early to say whether people would need new CPR numbers. The act already allows a new number in special cases of misuse. Reissuing a population identifier is not a password reset. It is a rewrite of every system that stored the old one: tax, health, banking, municipal services, the dead as well as the living, because the 8.8 million are not only the people who can pick up the phone. The register counts emigrated people and the dead. Their numbers can still be used to construct a life, open a relationship, or answer a question a fraudster should not have been able to ask.

The Book That Is Larger Than the Country

The CPR has been Denmark’s population book since 1968. It is not a snapshot of who lives in the country this year. It is the accumulated file of who has lived there: the living, the emigrated, the dead. That is why a register of about 11 million records sits in a country whose population, at the start of 2025, was just under 6 million. The extra rows are not padding. They are people who still have a number, and a number that other systems may still accept as a reference even when the person cannot pick up a phone.

A CPR number is ten digits. Six are the date of birth. Four are serial digits, and the last of those has long been used to encode sex — even for women, odd for men. The format is public. The secrecy, such as it was, lived in which combinations the register had actually issued, and in the name and address bound to each one. An automated lookup that asks the register which numbers are real is not guessing a password. It is asking a directory to confirm its own index. Datatilsynet’s description of the notification matches that shape: a very large number of automated lookups, made in order to identify valid CPR numbers. The police, at the October 6 briefing, said they were examining whether an algorithm had been used, as a hypothesis, because so many lookups happened in so little time. They would not say more. They also said, in those first hours, that it was not yet clear who was behind it or how the access was first obtained.

The ministry was careful about the fields. The unauthorized access stayed inside the classes of data private companies are permitted to receive. It did not include the names and addresses of people registered with name-and-address protection. That protection is a real legal status, used by people who have a reason not to be findable — victims, people in hiding, people whose safety depends on the directory lying by omission. The limit matters. It is not the same as saying those people were untouched. The ministry’s statement did not say their CPR numbers were excluded, and it did not say anyone would be told, individually, that they were among the 8.8 million. A number without a name is still a number that can be tested against other systems that already have the name.

Why the Invoice Knew First

DR’s report from the October 6 briefing is the operational heart of the case. The hint that something was wrong was not a systematic alarm. It was an expensive invoice. The register knew how to charge for lookups. It did not know how to shout when the lookups stopped looking like a two-person company’s ordinary business. An employee of the CPR administration noticed irregular behavior on the evening of October 2. Access was stopped. Datatilsynet received the notification on October 4. The public learned on October 5.

Egelund’s first description put the access at about ten days in September. Ritzau later reported a harder number: access from September 10 for 21 days and 17 hours. Either clock is an indictment of the monitoring. A lookup right used to walk a national register for two or three weeks is not a mistyped query. It is a job, and the billing system was taking notes the whole time. Queries per day, distinct subjects, the share of lookups that miss, the breadth of fields returned, the relationship between a company’s declared purpose and the set of people it asks about — all of that is computable from the invoice the state eventually noticed. The missing control was a threshold that pages a human before the bill does.

This is a class of failure, not a Danish quirk. Any registry that sells or meters access already has the telemetry of abuse. Credit bureaus, vehicle registers, health-record lookups, law-enforcement query portals: the log that produces the invoice is the log that should produce the alert. Volume ceilings per party. An alert when a vendor’s traffic departs from the customers it claimed to have. Immediate revocation, which did happen, once a person finally looked. The revocation on October 2 was correct. It was also three weeks late by the longer of the two public clocks. Egelund told Ritzau that red lights should have come on, and that the safeguards around this company’s access had not been good enough. She asked for a full security review. Agreement after the fact is not a control. It is the start of one.

Reissue Is Not a Reset

Egelund told Ritzau it was too early to say whether people would need new CPR numbers. The act already allows a new number in special cases of misuse. Reissuing a population identifier is not a password reset. It is a rewrite of every system that stored the old one: tax, health, banking, municipal services, the dead as well as the living. Emigrated people and the dead have numbers in the 8.8 million too, and those numbers can still be used to construct a relationship or open a file a fraudster should not have been able to open. A decision not to reissue has to be paired with a hard rule everywhere else: the number is an index, never a credential. A decision to reissue will take years and will still leave the old number in systems the state does not control.

The password finding and the claimant’s story should stay in separate drawers while that review runs. Politiken’s review of the data is a finding: three accounts, including an administrator, used 123456. The anonymous account of a leaked former-employee password and two retrieval programs is a claim, and the reporting did not establish that the former employee worked at Pays. A leaked credential is only as powerful as the door it still opens. A former employee’s password should have been dead the day they left. An administrator password should not have been a joke. Those are separate failures, and both of them sit inside the vendor the state had already trusted. The architecture does not need a named suspect to be condemned.

The Vendor Is the Register

The durable lesson is not that Denmark forgot to buy a firewall. The durable lesson is that a lookup right is a copy right if the lookup can be repeated without a ceiling.

Section 38 of the CPR Act is a reasonable piece of administration. Companies need to know if a customer has died, moved, or asked not to be given credit. The failure was not the existence of the interface. The failure was the belief that a two-person firm in Odense, authenticated by 123456, would only ever ask the questions its contract described. The ministry sets the terms of company access, including the security measures. Egelund said those measures were not good enough. That sentence should be read as an architecture review, not as a scolding.

A registry that bills per lookup already has the telemetry. Queries per day, distinct subjects, the share of lookups that miss, the breadth of fields returned, the relationship between a company’s declared purpose and the set of people it asks about — all of that is computable from the invoice the state eventually noticed. The missing control was a threshold that pages a human before the bill does. Per-party volume ceilings. An alert when a vendor’s traffic departs from the customers it claimed to have. Immediate revocation, which did happen, once a person finally looked. The revocation on October 2 was correct. It was also three weeks late by the longer of the two public clocks.

Pays ApS is not famous, and that is why the case will outlast the news cycle. National population registers are increasingly reached through small suppliers who hold a legitimate integration and an illegitimate password. The attacker does not need to phish a minister. The attacker needs the vendor account the minister’s system already trusts. Denmark learned that in public, with a password the entire industry has been mocking for twenty years, and with an invoice that knew the truth before the alarms did.

The police have not named anyone. The 8.8 million have already been named, to whoever held the other end of the lookup.

---

Attack Chain: Unauthorized CPR Access via Pays ApS

graph TD
    A["Lawful Access\nPays ApS of Odense holds a\nlegal right to look people up\nin Denmark's CPR register\nTwo employees on the books"] --> B["Credential Failure\nPolitiken: at least three accounts\nincluding the administrator\nused the password 123456\nClaimant says a former employee's\npassword leaked — unverified"]
    B --> C["Automated Enumeration\nFrom Sept 10, 2026\n21 days and 17 hours of access\nDatatilsynet: a very large number\nof lookups to find valid CPR numbers"]
    C --> D["National Exposure\nNames, addresses, and CPR numbers\nfor about 8.8 million of\n11 million records\nName-and-address protection\nlimits some fields, not the event"]
    D --> E["Detection by Invoice\nNo systematic alarm\nA costly bill hints at abuse\nCPR staff notice irregular\nbehavior on the evening of Oct 2"]
    E --> F["Containment\nCompany access stopped\nNotification to Datatilsynet\non Oct 4\nPolice visit the firm\nForeign police contacted"]
    F --> G["Public Disclosure\nOct 5, 2026: ministry confirms\nthe misuse of lawful access\nMinister Egelund: safeguards\nwere not good enough"]
    G --> H["Identity Collapse\nAgency director: a CPR number\ncan no longer authenticate\na person\nCredit warnings, MitID warnings,\nCyberhotline hours extended"]
    H --> I["Unresolved\nActor not named\nNew CPR numbers not yet decided\nFull security review requested\nPassword quality on vendor\naccounts is now the register's risk"]

    style A fill:#1a1a2e,color:#e0e0e0
    style B fill:#c0392b,color:#fff
    style C fill:#c0392b,color:#fff
    style D fill:#8e44ad,color:#fff
    style I fill:#2c3e50,color:#e0e0e0