Massive Data Breach Exposes Personal Records of 8.8 Million Danes via Weak Password A cyberattack on Denmark’s population register (CPR) exposed sensitive personal data of approximately 8.8 million individuals including 5.5 million living and 3.3 million deceased after attackers exploited a weak, leaked password. The breach occurred when unauthorized users abused a legitimate access point belonging to Pays ApS, an IT company in Odense that provides CPR data verification services for clients. The attackers gained entry using the password "123456", which had been exposed in a prior data leak and was linked to a former Pays employee. Despite the password’s obvious vulnerability, the system failed to block it, allowing the attackers to conduct 14 million searches over 21 days before access was revoked on October 2. Suspicious activity reportedly ceased on September 20, but the breach was only detected after an unusually high billing alert flagged the excessive queries. The compromised data included names, addresses, and CPR numbers Denmark’s unique personal identification numbers posing significant risks for identity theft and fraud. Authorities confirmed the incident but have not disclosed further details on the attackers’ motives or whether the stolen data has been misused. The breach highlights critical security failures, including the lack of multi-factor authentication (MFA), weak password enforcement, and delayed detection of anomalous activity. Pays ApS has acknowledged the abuse of its authorized access but has not provided additional public statements. Danish officials continue to investigate the scope and impact of the incident.