Major Danish Data Breach Exposes 8.75 Million Records Due to Weak Passwords A significant cybersecurity incident in Denmark has compromised 8.75 million records from the country’s Central Person Register (CPR), including national identification numbers and addresses of 5.5 million living and 3.3 million deceased individuals. The breach stemmed from weak password security at Pays ApS, an IT company with authorized access to the government database. The attacker exploited three accounts at Pays, including an administrator account, all secured with the password "123456". The unauthorized access began on September 10 and persisted for 21 days and 17 hours, during which the hacker allegedly used two custom programs to extract and store personal data outside the system. The breach was not a direct attack on the CPR but rather a misuse of legitimate third-party credentials. Pays, based in Odense, had permission to access the CPR for business purposes, such as verifying customer information. However, the incident highlights third-party cybersecurity risks, as attackers increasingly target authorized vendors rather than breaching central systems directly. The breach also underscores the persistent threat of weak passwords, with "123456" remaining a commonly exploited credential in cyberattacks. While the attacker claimed the data would not be sold or publicly released, the exposure raises concerns about identity fraud risks and the need for stronger monitoring of bulk data access. Danish authorities and Pays have not confirmed any misuse of the compromised records, but the incident has prompted scrutiny over password policies, third-party oversight, and safeguards for sensitive government databases.