Denmark’s population register breach exposed 8.8 million people — password reportedly 123456

Personal identification numbers, names and addresses belonging to nearly 8.8 million people were retrieved from Denmark’s population register, known as the CPR register, in September 2026. The figure effectively covers the country’s entire population, including people who have died. Denmark’s Ministry of Research, Education and Digitalisation announced the breach on Monday 5 October. A few days later, a detail emerged that has drawn attention across Europe: according to the hacker’s own account, the password used to gain access was 123456.

nn

What happened?

n

The CPR register is Denmark’s central population database, in which every resident has a unique CPR number. Like Finland’s personal identity code, it is an everyday identifier used across society. Private companies and organisations can also access the register under certain conditions, for instance to check a customer’s or member’s current address.

n

That access for businesses was the weak point. According to Ingeniøren and The Copenhagen Post, someone used the credentials of a small IT company in Odense to retrieve information from the register during September. An estimated 14 million queries were made. The company has confirmed to Denmark’s TV 2 that it was targeted and has been disconnected from the register.

n

The breach was not uncovered by a monitoring alert. According to The Copenhagen Post, it came to light only when the CPR office received an unusually large bill for queries made through the company’s account. The breach was discovered on Friday 2 October.

nn

How was access gained?

n

A few days after the breach was announced, an anonymous person contacted Politiken through an encrypted messaging service, claiming responsibility. According to The Local and The Copenhagen Post, the person said they had used a former employee’s password, which had been exposed in an earlier, unrelated breach. The password was 123456 and, they claimed, it was used for several company accounts, including the administrator account.

n

The hacker said they built two programs: one to retrieve data from the register and another to save it elsewhere. They said artificial intelligence wrote the code. Security specialists who reviewed Politiken’s material, including Emil Hørning of Defend Denmark, consider the hacker’s account likely to be true. However, the password claim comes from the hacker’s own account, rather than a technical report published by the authorities.

n

The hacker has said they do not intend to sell or publish the data.

nn

How could a population register accept the password 123456?

n

This is the most astonishing aspect of the case. This was a state-run register holding the personal identification number of effectively every Dane. Yet it could be accessed using an account with a password that ranks among the world’s most common year after year.

n

Responsibility extends beyond one small company. When a system allows a login with the password 123456, the system itself is also at fault. A carefully designed service rejects such a weak password outright. It also requires a second authentication factor, such as a text message code or an authenticator app, and raises an alert when a small customer suddenly makes millions of queries. Aarhus University cybersecurity researcher Jens Myrup Pedersen put it bluntly to The Copenhagen Post: “There was practically no security; it was an open door.”

n

Denmark’s digitalisation minister Christina Egelund has also acknowledged to the Ritzau news agency that the CPR system’s security has not been good enough. She has commissioned a security analysis and says new measures have been introduced to prevent similar unauthorised access.

nn

What could happen next?

n

For now, the consequences can only be estimated. Even if the hacker says they will not distribute the data, its security cannot be taken for granted. Once copied, it could fall into the wrong hands later.

n

n
• More scams. Name, address and personal identification number make it easy to phone someone and convincingly pose as a bank, a public authority or the police. Denmark’s justice minister Nicolai Wammen has already urged people not to disclose passwords or other confidential information by phone or email, even if the caller knows their personal details.

n

• A greater risk of identity theft. A personal identification number alone does not open a bank account, but combined with other information it makes impersonation easier.

n

• A review of register access. Access for businesses is likely to be tightened, with two-factor authentication becoming mandatory.

n

• A debate beyond Denmark. Finland’s Digital and Population Data Services Agency, Digi- ja väestötietovirasto, told the Finnish public broadcaster Yle that it is in contact with the Danish authorities. The Finnish agency says a similar breach would theoretically be possible in Finland too, but queries there require a personal identity code that is already known.

n

nn

A lesson for everyone: 123456 is no password

n

The Danish case is a reminder for every business, however small. One weak password on a former employee’s account was enough to expose an entire country’s population data. These are the checks to make in your own business now:

n

n
• Never use easy passwords. Examples such as 123456, 000000, qwerty, password or a company name followed by a year can be guessed in seconds. A long passphrase, such as four unrelated words, is both stronger and easier to remember.

n

• Use a different password for every service. According to the hacker, the password used in Denmark had already leaked elsewhere. A password manager remembers your passwords for you.

n

• Enable two-factor authentication wherever possible. Even if a password leaks, it will then be insufficient on its own to log in.

n

• Remove former employees’ accounts immediately. The Danish breach began with an account that should no longer have worked.

n

• Watch for unusual activity. If a system suddenly handles a thousand times its normal number of queries, an alert should come immediately, rather than with the bill.

n

n

If you build or buy a system, demand the same of it: a good service will not even accept the password 123456.

nn

Read also

• Self help industry is failing founders
• Self help lessons founders actually use
• Wealth creation uk high street budget tax

Sources

• The Local Denmark: Cybercriminal claims to have used simple password to hack Danish CPR system (9.10.2026)
• The Copenhagen Post: ‘123456’ password used in massive Danish CPR data breach (10.10.2026)
• TechPowerUp: Hacker says a “123456” password got them into Denmark’s ID register
• Ingeniøren: Millioner af CPR-numre var beskyttet med adgangskoden 123456 (9.10.2026, in Danish)
• Ritzau / sn.dk: It-kriminel hævder at stå bag CPR-angreb (in Danish)