A six-character password appears to sit behind one of the largest privacy failures in Danish history. A person who says they broke into the country’s Central Register of Persons, known as CPR, told the newspaper Politiken that an IT company’s account guarded by 123456 was the way in, and that at least three accounts, one of them administrative, shared it.
The CPR administration confirmed on October 5 that information on 8.8 million people was accessed after a Danish firm’s legitimate access was abused. Funen-based Pays ApS later acknowledged its credentials were the ones used. The supplier had authorised reach into the register to validate business customer records.
Three weeks of quiet lookups
Documents obtained by broadcaster TV 2 put the first unauthorised access on September 10. Between then and September 20 the intruder ran roughly 14 million automated searches. Nobody noticed until October 2, twelve days after the traffic stopped, when a department staffer flagged an invoice showing unusual activity. The data protection authority was told on October 4 and the government went public a day later.
The register holds about 11 million entries, including deceased people and citizens living abroad, so the 8.8 million figure reflects living residents.
The person claiming responsibility said they never intended to sell or leak the files. Danish officials have offered no such assurance, and the case is a reminder that a supplier’s weakest credential is often the whole perimeter.
