Denmark's Biggest Breach Ran on the Password '123456'

The keys to a nation, guarded by '123456'

On October 5, the Danish government confirmed the biggest data breach in the country's history. Attackers stole records on 8.8 million people from the Central Person Register — the CPR, the database holding every citizen's government identity number, used for taxes, healthcare, and public services. Names, addresses, Danish social security numbers. Denmark's population is about 6 million; the register holds 11 million records including the deceased and Danes living abroad. Most of it walked out the door.

The government wouldn't name the attacker. But it said the unauthorized access came from abusing a Danish company's lawful access to search the CPR. Then Danish media found the company: Pays ApS, a small IT firm in Funen whose access had been exploited. And a person claiming responsibility told the newspaper Politiken the way in was an account protected by the password '123456.' At least three company accounts — including an administrator account — allegedly used the same password.

How it happened

According to documents obtained by broadcaster TV 2, the attacker entered the CPR system on September 10 and ran 14 million automated searches between then and September 20. The intrusion was detected on October 2 — twelve days after the last reported searches — when a department staffer noticed an invoice showing unusually high activity from Pays. Think about that: the alarm that caught the largest breach in Danish history was a billing anomaly.

Minister Christina Egelund called it a serious incident. Pays' managing director confirmed on October 9 that the company's access had been exploited. Its website went offline. The company has not answered questions about the password claims, and the government hasn't confirmed them either. But nobody has denied them, and the circumstantial evidence is damning: three accounts, one administrator, all '123456.'

This is what third-party risk looks like

The Denmark data breach is what third-party risk looks like at national scale: Denmark's own systems may have been fine. The breach came through a vendor with legitimate access — the oldest story in cybersecurity, retold at national scale. Companies like Pays exist because verifying identity against the CPR is a legitimate business need. Every such integration is a door, and this door had the security equivalent of a 'welcome' mat.

The pattern is global. The 2016 breach of Turkey's national identity database exposed tens of millions of citizens. India's Aadhaar database has repeatedly spilled citizen data through third-party exposures. National ID systems concentrate risk by design: one register, every citizen, total compromise if the perimeter fails.

What actually would have stopped this

Not a fancier firewall — basic credential hygiene. Unique, strong passwords on every account. Multi-factor authentication on anything touching a national database. Monitoring that flags 14 million searches from a small IT vendor in ten days, rather than waiting for an invoice. The uncomfortable truth is that none of this is exotic. It's the checklist every security audit has recommended for twenty years, and the largest breach in Danish history happened because a company with access to 11 million citizens' records skipped all of it.

If you're in the register, there's little to do except watch for identity fraud — and freeze your credit where that's available. For the rest of us, the lesson is closer to home: your company is only as secure as its laziest credential. Audit yours with our breach exposure guide, and compare notes with the SourceNext breach, where the passwords were 'encrypted' rather than hashed — 2026 has been a masterclass in how not to store credentials.