Full Breakdown
Denmark’s CPR Register Breach Exposes 8.8 Million Records via a Weak Third-Party Password
By Drooid · · How we work
Core Event: Unauthorized Access Through a Simple Password
A hacker claiming responsibility for the breach of Denmark’s Central Person Register (CPR) said they gained entry by using the password “123456” on an account belonging to Pays ApS, a small IT and data-services firm on Funen. The attacker used the compromised credentials to run automated queries that extracted personal identification numbers, names and addresses from the CPR database.
Background & Context
The CPR is Denmark’s national civil-registration system, holding data for roughly 11 million individuals, including residents, expatriates and deceased persons. Private companies may receive legal permission to query the register when they have a legitimate business need. Pays ApS held such authorized access and was therefore able to retrieve CPR records through the official interface.
Timeline
- September 10 – The attacker accessed the CPR system using the leaked “123456” password.
- September 10 – September 20 – Documents obtained by broadcaster TV 2 show the hacker executed 14 million automated searches.
- October 2 – The intrusion was detected when a government employee flagged an unusually high invoice from Pays ApS.
- October 4 – Datatilsynet was notified of the breach.
- October 5 – The CPR administration confirmed that information belonging to 8.8 million people had been accessed.
- October 9 – Managing director Sophie Laursen confirmed that Pays ApS’s authorized access had been misused.
Data & Statistics
- Records exposed: Politiken reported 8,749,975 CPR entries were copied, rounded to “about 8.8 million.”
- Living vs. deceased: Approximately 5.5 million of the compromised records relate to living individuals and 3.3 million to deceased persons.
- Query volume: The 14 million searches represent more than one query per record.
Official Statements & Responses
- The CPR administration announced on October 5 that a Danish company’s legal access had been abused, affecting 8.8 million records.
- Sophie Laursen, managing director of Pays ApS, acknowledged that the company’s credentials had been exploited and that the website had been taken offline.
- Mikkel Leihardt, director of the Ministry of Higher Education and Science, said a staff member noticed the high invoice, triggering the investigation.
- Datatilsynet confirmed receipt of the breach report on October 4 and began its regulatory review.
Impact and Lessons
The breach highlights risks in granting third-party organizations privileged access to national identity databases. Experts noted that using a common password across multiple accounts violated basic credential-management practices. Recommendations include:
- Blocking widely used passwords such as “123456” and enforcing password-strength policies.
- Implementing multi-factor authentication for all privileged accounts.
- Disabling accounts belonging to former employees.
- Limiting query volumes per account and establishing automated alerts for bulk data extraction.
The incident shows how compromised third-party credentials can provide a “supply-chain” route to sensitive government data, even when the underlying system itself remains technically unbreached.