A reported cybersecurity incident involving Denmark’s national population registry has raised concerns over third party security practices after attackers allegedly gained access to sensitive information belonging to around 8.8 million individuals. The breach reportedly occurred through a company authorised to access the Danish Central Register of Persons (CPR), with claims that weak login credentials were used to enter systems connected to the registry. Reports surrounding the incident stated that a password as simple as “123456” was allegedly among the credentials used by an attacker to gain access, highlighting concerns about password management and security controls within organisations handling sensitive government data.
The Danish Central Register of Persons (CPR) contains important identity information for people living in Denmark, including names, addresses, birth dates, citizenship details and marital status. Each individual is assigned a unique 10 digit CPR number that is widely used across essential services such as healthcare, taxation and banking. In a statement, CPR confirmed that an unauthorised party gained access to its systems by misusing a Danish company’s legitimate access rights to search information within the registry. Authorities did not initially disclose details about the attacker or the organisation involved, stating that investigations were ongoing and additional security measures were being implemented to strengthen protection around the system.
Further reports identified Funen based company Pays ApS as the organisation through which the access reportedly took place. Pays had authorised access to the CPR system, and the unusual activity was discovered after a government employee noticed a significantly higher than expected number of searches linked to the company during the previous month. According to local reports, the attacker allegedly carried out approximately 14 million automated searches over a period of ten days. The company’s website was temporarily taken offline during the investigation but was later reported to be operating normally. The incident has drawn attention to the security responsibilities of third party organisations that manage access to sensitive government databases and the importance of maintaining strong authentication measures.
Additional details from Danish media reports suggested that the individual claiming responsibility for the breach accessed the system using credentials belonging to a former employee. The reported password associated with the account was “123456”, and the attacker allegedly stated that three different accounts were using the same simple password. After gaining access, the individual reportedly created scripts to extract information from the CPR system and transfer it to another system. The person claimed that the stolen information would not be leaked or sold and expressed surprise at the security weaknesses they allegedly encountered. A file containing CPR numbers was reportedly shared with a publication, and its authenticity was reviewed with assistance from cybersecurity researcher Emil Hørning, who said the account and described methods appeared credible.
Despite claims that the information would not be publicly distributed, cybersecurity experts have highlighted the potential risks associated with exposure of personal identity data. Names, addresses, birth dates and CPR numbers can provide valuable information for targeted phishing attempts, identity misuse and other cyber threats. The incident demonstrates the importance of stronger access controls, secure password practices and continuous monitoring for organisations handling sensitive information. As governments and businesses increasingly rely on interconnected systems and third party services, maintaining robust cybersecurity measures across the entire access chain remains essential for protecting personal data and reducing risks associated with unauthorised access.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
