Denmark’s digitalisation ministry said in a press release on 5 October that someone had misused a private company’s legal access to the country’s Central Person Register (CPR), reaching names, addresses and CPR numbers for around 8.8 million people. A week later, the person claiming responsibility said the way in was a supplier account protected by the password 123456.
That detail is unconfirmed, but the setup will be familiar to any agency that shares logins with freelancers or suppliers.
What happened
The CPR is Denmark’s national population register. CPR numbers underpin tax, healthcare and banking, The Register reported. Private companies can get access for defined purposes, and Pays ApS, a small IT company on Funen, used its access to validate business customers’ records.
According to documents obtained by Danish broadcaster TV 2, as reported by The Register, the attacker first got into the system on 10 September and ran 14 million automated searches up to 20 September. This was a misuse of live access in real-world use.
The ministry says irregular activity was noticed on the evening of Friday 2 October. The 8.8 million figure includes people who have died or moved abroad, which is why it’s higher than Denmark’s population; the register holds about 11 million records. People registered with name and address protection weren’t included. The ministry hasn’t published a revised figure.
Mikkel Leihardt, a director at the ministry, told a press conference that a member of staff picked up an invoice showing unusually high activity from Pays. That was 12 days after the last reported searches. Datatilsynet, the Danish data protection authority, was notified on 4 October and the government went public the next day.
The password detail comes from the person claiming responsibility, who told the Danish newspaper Politiken that they got in through an account protected by 123456. Politiken reported that at least three Pays accounts, including an administrator account, used the same password. The same person said they don’t intend to sell or leak the data.
What Pays and the Danish government have said
The ministry called it a serious security incident. Minister Christina Egelund called it deeply serious and has ordered a thorough security review of the CPR system. The company’s access has been stopped, police are investigating, and the ministry says it’s too early to say who’s behind it.
The government didn’t name the company. Pays managing director Sophie Laursen confirmed on 9 October that its access had been exploited. Neither Pays nor the government responded to The Register’s questions about the password claims. In a TV interview, Egelund said it was too soon to say whether Denmark would issue new CPR numbers.
Still unknown: who’s responsible, whether the password claim is accurate, and why 14 million searches weren’t picked up while they were happening.
What it means for you
A small supplier held a legitimate login to something far bigger than itself, and the security of that login sat entirely with the supplier.
Think about who outside your payroll can sign in today: the freelancers in your Google Workspace, the partner agency added as guests in Teams, the developer with admin rights on your website, and your IT supplier with admin roles in Apple Business and your DMS (formerly MDM) platform. Your own password policy and MFA rules may not reach any of those accounts.
Not sure who outside your business can still sign in?
Our cyber security service covers this and a whole lot more.
The other half of the Danish story is detection. It took an invoice to spot the misuse. Your equivalent is the sign-in alerting you already pay for. Google Workspace can email admins about suspicious sign-in activity, including a successful sign-in from a suspended account. Microsoft 365 keeps sign-in logs in the Entra admin centre. Neither helps if nobody reads them.
We’re one of those suppliers for our own clients, so we’d expect you to ask us the same questions.
What we’d do now
- List every account held by someone who isn’t on your payroll, including guest users in Microsoft 365 or Google Workspace and admin roles in Apple Business and your DMS. Remove anything nobody can explain.
- Put MFA on every one of those accounts and stop sharing single logins between people. Where a supplier needs a credential, share it through 1Password rather than email or a spreadsheet, so access can be removed in one place.
- Switch on sign-in alerts and give one named person the job of reading them.
- Ask each supplier how they protect the access you’ve given them, and get the answer in writing.
If you’d like a hand with the first step, our cyber security team can run the review with you.
Related articles
- Why most UK businesses are failing Cyber Essentials Control 3 and how 1Password fixes it
- MFA, SSO, and password managers: what your Mac-first business actually needs in 2026
- Your team still needs a password manager, even with passkeys everywhere
FAQs
Was Denmark's CPR system itself hacked?
The ministry says the access came through a private company’s legal access to search the register, within the limits of what private companies are allowed to see. In other words, someone used a supplier’s working login. The ministry has ordered a full security review of the CPR system all the same.
Did a password of 123456 really cause the breach?
That’s the claim of the person who says they did it, as reported by Politiken. Politiken also reported that at least three Pays accounts used it. Pays has confirmed its access was exploited, but neither Pays nor the Danish government has confirmed the password detail.
Could people in the UK be affected?
The register covers people who live in Denmark and also people who have moved abroad, so a colleague who once lived there could be included. The Danish ministry’s advice is never to give out passwords by phone or email, even when the caller already knows your name, address and CPR number.
What's the quickest useful thing we can do this week?
Pull a list of every guest, external and supplier account in Microsoft 365 or Google Workspace, plus admin roles in Apple Business and your DMS. Anything nobody can explain gets removed. Most agencies can do this in an afternoon, and it’s the step everything else depends on.
