Major CPR Data Breach in Denmark Linked to Weak Password at Small IT Firm A hacker accessed Denmark’s Central Person Register (CPR), exposing approximately 8.8 million CPR numbers nearly the country’s entire population after compromising a small IT company, Pays ApS. The breach reportedly stemmed from the use of the notoriously weak password “123456” on an administrative account, which provided access to the national database. Pays ApS, a two-employee firm based in Odense, confirmed the incident after Danish broadcaster TV 2 reported the breach. The company’s managing director, Sophie Laursen, acknowledged that its authorized access to the CPR system had been abused. An anonymous hacker later told Politiken that the intrusion began with a leaked password from a former employee and lasted 21 days and 17 hours, starting on September 10th. The attacker claimed to have used automated tools to extract data but denied plans to sell or publish it. The CPR system contains records on roughly 11 million individuals, including residents, expatriates, and deceased persons. While multiple organizations hold authorized access for administrative tasks, the breach highlights vulnerabilities in third-party security practices. Denmark’s reliance on MitID, a two-factor authentication system, limits direct impersonation risks from exposed CPR numbers alone. However, cybercriminals could exploit the data for phishing and social engineering attacks, combining it with other breached information to craft more convincing fraud attempts. Danish authorities have urged citizens to remain cautious of unsolicited messages containing personal details. The incident underscores the risks of weak security controls in organizations with access to sensitive national infrastructure.