A hacker claims they breached Denmark's Central Register of Persons (CPR) using the weak password '123456' on accounts at Pays ApS, a two-employee IT company in Odense with authorized access. At least three accounts, including an administrator, used this password. Danish authorities confirmed the breach on October 5, exposing names, addresses, and CPR numbers of around 8.8 million people, including deceased individuals and those abroad.
Pays managing director Sophie Laursen confirmed on October 9 that the company's access was abused, and its website is now offline. The attacker gained access on September 10 and performed roughly 14 million automated searches by September 20. The breach went unnoticed until October 2, when a ministry staffer spotted an invoice showing unusual activity from Pays.
Some reports suggest the initial entry came via a leaked password from a former employee, though details remain unclear. The hacker states they have no plans to sell or leak the data, but Denmark's Agency for Public Security (Samsik) says CPR numbers can no longer be trusted alone for identity verification. Citizens are advised to watch for phishing attempts using personal details and to stop using '123456' anywhere.
Source: TechPowerUp News · Summarized by HeadlinesBriefing