Denmark’s 8.8 Million-Record Data Breach Linked to Accounts Using ‘123456’ Password

A reported breach linked to Pays, a Danish company with authorized access to the national CPR register, exposed roughly 8.7–8.8 million CPR numbers and addresses after an attacker used leaked/weak credentials (several accounts reportedly used "123456") to run automated retrieval programs over ~21 days; authorities warn of phishing and identity risks while observers highlight preventable lapses (lack of MFA, poor password hygiene, incomplete offboarding) and note independent forensic confirmation is not cited.