Denmark Data Breach Involving 8.8 Million Records Linked to ‘123456’ Password

A data breach at Pays ApS in Odense resulted in the unauthorized export of roughly 8.7–8.8 million Danish Central Person Register (CPR) records — about 5.5 million living individuals and 3.3 million deceased — after an attacker used leaked credentials and weak passwords (including “123456”) on at least three accounts, one with administrator privileges. The attacker accessed Pays’ authorized interface to the CPR system for about 10–21 days, created programs to retrieve and save personal data outside the register, and claimed they do not intend to sell the data; authorities have not found evidence MitID or the register infrastructure itself was compromised, but the exposure enables profiling and phishing risks.