TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Politiken reports that at least three accounts at Pays ApS, including an administrator account, used the password “123456” when the company’s access to Denmark’s CPR register was compromised. The reported access lasted 21 days and 17 hours and involved information linked to around 8.8 million CPR numbers; the full scope of data accessed has not been established in the material available.
At least three Pays ApS user accounts, including an administrator account, reportedly used the password “123456” when the company’s access to Denmark’s central civil registration register was compromised, according to Politiken. The incident involved information linked to around 8.8 million CPR numbers, making the reported weakness relevant to people living in or previously registered in Denmark.
Politiken said it reviewed data that the hacker allegedly used to gain access to the system. The newspaper reported that three Pays accounts were protected by the highly common password, including an account with administrator privileges. The report does not establish from the material provided how many records were actually viewed, downloaded or retained.
Pays, an IT company based in Odense, confirmed to TV 2 that its authorized access to the CPR system had been abused. Managing director and owner Sophie Laursen said in an email that the company had been attacked. The reported access to the register lasted 21 days and 17 hours, beginning September 10.
An anonymous person who told Politiken they carried out the attack claimed that access was obtained through a leaked password belonging to a former employee of a small Danish company. The person also said they created two programs to retrieve CPR information and store it externally. These details are the hacker’s account, not independently established facts in the source material. The hacker told Politiken there were no plans to sell or publish the information.
Risks to CPR Information
The CPR register is Denmark’s central civil registration database and holds personal information on people who live in or have previously been registered in the country. Information connected to around 8.8 million CPR numbers means the reported incident may affect a broad population, although the number linked to the register is not a confirmed count of people whose records were accessed or copied.
Companies and associations can receive access when they have a legitimate need, such as checking customer or member addresses. A compromise at an authorized user can therefore create risk beyond the organization itself: the issue concerns how access to a central public database is protected and monitored. The reported use of “123456” on an administrator account has drawn particular attention because such an account can carry elevated permissions. The precise permissions and activity of the affected accounts have not been detailed in the material available.
Products Worth Considering
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How Pays Accessed the Register
The CPR system is used to maintain Denmark’s civil registration information. Its records cover people living in Denmark as well as people who were registered there previously. Access is not limited to government agencies: private organizations may be granted access for defined, legitimate purposes, including obtaining addresses for customers or members.
Pays ApS is based in Odense. Denmark’s Central Business Register listed the company as having two employees as of July 2026. The size of the company provides context for its role as an authorized user but does not, by itself, establish what security controls it had or how the breach occurred.
The anonymous hacker told Politiken on Thursday that gaining access had not been particularly difficult. Professor Jens Myrup Pedersen of Aarhus University’s Department of Electrical and Computer Engineering criticized the reported password practices. Politiken’s report, Pays’ confirmation to TV 2 and the hacker’s claims are distinct sources: the company confirmed an attack involving its CPR access, while the reported password details and account of the intrusion were attributed to the newspaper and the anonymous individual.
“There is really no security, it is an open door. A password like ‘123456’ is one of the very first things you would guess if you took a list of common passwords.”
— Jens Myrup Pedersen, professor at Aarhus University, speaking to Politiken
Scope of Access Still Unknown
The reported figure of around 8.8 million CPR numbers describes the information linked to the breach, not a confirmed tally of records accessed, copied or exposed. The material provided does not say which specific data fields were retrieved, how many people’s records were affected, or whether the information remains in the attacker’s possession.
The account of how the intrusion began—including the claim that a former employee’s leaked password was used—comes from an anonymous person who said they were responsible. The source material does not provide an independent confirmation of that sequence. It also does not explain how the three reported “123456” accounts relate to the alleged initial access, or whether those accounts were used to retrieve data.
There is no detailed account in the supplied reporting of the investigation’s findings, the company’s security response, or any steps taken to notify affected people. The hacker’s claim that the information would not be sold or published should not be treated as proof that it was not copied, shared or otherwise used.
Investigation and Public Guidance
The next key developments are likely to clarify what information was accessed, how the compromised access was used, and whether investigators can establish the amount of data copied or retained. The material provided does not specify a timetable for further findings or identify a forthcoming public report.
Any guidance for people whose information may be involved, or any formal findings about Pays’ account security and access controls, would help establish the practical consequences of the breach. Until those details are available, the reported scale, the company’s confirmation of compromised CPR access and the hacker’s unverified account should remain clearly distinguished.
Key Questions
What happened in the Danish CPR breach?
Pays ApS confirmed to TV 2 that an attack had abused its authorized access to Denmark’s CPR register. Politiken reported that at least three Pays accounts, including an administrator account, used the password “123456”.
How many people were affected?
The report says the breach involved information linked to around 8.8 million CPR numbers. That figure does not confirm how many records were accessed or copied, or how many people were directly affected.
How long did the reported access last?
The reported access began on September 10 and lasted 21 days and 17 hours, according to the source material.
Is the alleged attack method confirmed?
No. An anonymous person who told Politiken they carried out the attack claimed they used a leaked password belonging to a former employee. The material provided does not independently confirm that account or explain how it connects to the reported Pays passwords.
Was the information published or sold?
The anonymous person told Politiken there were no plans to sell or publish the information. That statement is an attributed claim; the supplied reporting does not establish whether data was retained, shared or used in another way.
Source: hn
