Story perspectives

Hacker Steals 8.8 Million Danish CPR Records

By Drooid · Oct 15, 2026, 11:56 AM UTC · How we work

Summary

Hacker Breaches Registry

A hacker exploited a “123456” password at Pays ApS to breach Denmark’s national registry.
The intruder ran 14 million automated searches from September 10 to September 20, 2026.
Copenhagen officials detected the breach on October 2 after an unusual invoice flagged the activity.
Pays ApS managing director Sophie Laursen said the hacker exfiltrated 8.8 million records, covering 5.5 million living and 3.3 million deceased citizens.
Experts warned that simple passwords are unacceptable for national databases and urged multi-factor authentication.

Summary

Attacker Exploits CPR

An attacker accessed Denmark’s CPR system, conducting 14 million searches from September 10 to September 20.
The Danish Data Protection Authority was notified of the breach on October 4.
The government publicly disclosed the incident on October 5.
Mikkel Leihardt, director of the higher education and science ministry, said an unusually high invoice prompted the probe.
Pays ApS took its website offline after the breach, TV 2 reported.

History

Historical Context

In 2017, Equifax’s failure to patch an Apache Struts flaw let hackers steal personal data of about 147.9 million Americans, leading the FTC to impose a $700 million settlement and calls for stronger authentication. The September 2026 breach of Denmark’s CPR registry revived concerns from the Equifax incident and prompted Danish and EU regulators to require multi-factor authentication for sensitive databases.

1 of 3

Hacker Breaches Registry

A hacker exploited a “123456” password at Pays ApS to breach Denmark’s national registry.
The intruder ran 14 million automated searches from September 10 to September 20, 2026.
Copenhagen officials detected the breach on October 2 after an unusual invoice flagged the activity.
Pays ApS managing director Sophie Laursen said the hacker exfiltrated 8.8 million records, covering 5.5 million living and 3.3 million deceased citizens.
Experts warned that simple passwords are unacceptable for national databases and urged multi-factor authentication.

1 / 3