TL;DR
Get business pricing on networking and server gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Politiken reports that at least three accounts at Pays ApS, including an administrator account, used the password “123456” when the company’s access to Denmark’s CPR register was abused. Pays confirmed that its authorized access was compromised; the reported exposure involves information linked to around 8.8 million CPR numbers. The precise information accessed and whether it was distributed remain unclear.
At least three accounts at Pays ApS, including an administrator account, reportedly used the password “123456” when hackers accessed the company’s authorized connection to Denmark’s central civil registration system, Politiken reported. Pays confirmed that its access had been abused. The incident involved information linked to around 8.8 million CPR numbers, although the scope of information actually retrieved has not been fully established in the source material.
Politiken said it reviewed data that the hacker allegedly used to gain access and reported that at least three Pays user accounts had the weak password. The company, based in Odense, had legitimate access to search the CPR system. Its managing director and owner, Sophie Laursen, confirmed to TV 2 that the company had been targeted and that its access was misused. Her statement confirms a compromise of Pays’ access, but does not independently verify every detail of the reported method or the amount of data taken.
The reported access began on September 10 and lasted a total of 21 days and 17 hours. An anonymous person who told Politiken they carried out the attack said they obtained access using a leaked password belonging to a former employee of a small Danish company. The person also claimed to have created two programs to retrieve CPR information and store it externally. Those accounts are the hacker’s claims, not independently confirmed details in the supplied reporting.
The hacker told Politiken there were no plans to sell or publish the information. That statement does not establish whether copies were made, whether any other party received data, or whether the information remains accessible. The reported breach concerns information associated with CPR numbers; the source material does not specify the categories of personal details retrieved for each record.
Risks From Misused CPR Access
The CPR system is Denmark’s central civil registration database, holding personal information about people who live or have previously been registered in the country. A breach involving data linked to millions of CPR numbers can raise concerns about privacy and the potential misuse of personal information. The number of CPR numbers associated with the incident should not be read as confirmation that every corresponding record was accessed or copied.
The reported use of “123456” on multiple accounts also puts attention on the safeguards governing private organizations’ access to public-sector data. Pays had a legitimate reason to use the system, according to the report’s description of the access arrangement; the issue is that authorized access was reportedly abused. Whether the company’s account practices or other controls contributed to the incident will require findings beyond the accounts of the newspaper and anonymous hacker.
password manager for secure passwords
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How Pays Could Search CPR
Denmark’s CPR register is used to maintain civil registration information. Private companies and associations may be granted access when they have a legitimate need, such as checking address information for customers or members. Pays’ access was for searching the register, and the company told TV 2 that this legal access was abused in an attack.
According to Denmark’s Central Business Register, Pays ApS had two employees as of July 2026. That figure describes the company’s reported staffing at that point; it does not establish how access credentials were managed or what security measures were in place. The available account links the reported password issue to at least three user accounts, one of them an administrator account.
Politiken’s reporting also included comments from Jens Myrup Pedersen, a professor in Aarhus University’s Department of Electrical and Computer Engineering. He criticized the password security described in the report. His assessment is expert commentary on the reported password practice, rather than a published technical investigation of the full breach.
“There is really no security, it is an open door. A password like ‘123456’ is one of the very first things you would guess if you took a list of common passwords.”
— Jens Myrup Pedersen, professor at Aarhus University, speaking to Politiken
encrypted external hard drive for data backup
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Scope and Data Exposure
The available reporting does not establish which specific personal details were retrieved, how many records were actually accessed or copied, or whether the information was passed to anyone else. The figure of around 8.8 million refers to CPR numbers linked to the breach, not a confirmed count of records extracted.
The reported password use and the alleged route into the system are based on Politiken’s reporting and an anonymous hacker’s account. The supplied material does not describe an independent forensic report confirming those details. It also does not say whether investigators have verified the hacker’s claim that data will not be sold or published, or whether Pays’ systems have been secured against further access.
multi-factor authentication security key
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Investigation and Access Review
The next key developments are likely to clarify the extent of the exposure and how Pays’ access was compromised. The supplied reporting does not identify a public timetable for investigation results or state what remedial steps the company or CPR authorities have taken. Readers should distinguish any future technical findings from claims made by the anonymous hacker.
Further reporting or official statements could establish what information was accessed, whether it was retained or shared, and what changes have been made to account security and third-party access. Until those details are confirmed, the reported duration and the number of CPR numbers linked to the incident describe the scale of the concern, not a complete accounting of affected records.
As an affiliate, we earn on qualifying purchases.
Key Questions
What happened in the Danish CPR breach?
Pays ApS confirmed that its authorized access to the CPR register was abused in an attack. Politiken reported that at least three company accounts, including an administrator account, used the password “123456.”
How many CPR numbers were involved?
The breach was linked to information associated with around 8.8 million CPR numbers. The available reporting does not confirm that all of those records were accessed or copied.
What information was taken?
The supplied reporting does not specify which personal details were retrieved or how many individual records were copied. It says the hacker allegedly used programs to retrieve CPR information and store it externally.
Was the data published or sold?
An anonymous hacker told Politiken there were no plans to sell or publish the information. That is the hacker’s claim; the reporting does not independently establish whether the data was shared or remains accessible.
How long did the reported access last?
The reported access began on September 10 and lasted 21 days and 17 hours. The supplied source does not provide further details about when the compromise was discovered or what response followed.
Source: hn
Columbus Day / Indigenous Peoples' Day Picks
long weekend sales
As an affiliate, we earn on qualifying purchases.
