Denmark's CPR administration confirmed a serious incident in which unauthorized parties abused a company's authorized CPR search access. Pays ApS (Odense) confirmed its access was misused. Danish reporting (TV 2 / Politiken) says at least one account used the password 123456 (a leaked former-employee credential), and that about 14 million automated searches ran roughly Sept 11–20, exposing names, addresses and CPR numbers for about 8.8 million people (~5.5M living / ~3.3M deceased per Politiken). Access was shut down Oct 2 after an unusually large invoice flagged the activity. Lesson for anyone with government-register API access: reject weak passwords, require MFA, and alert on anomalous search volume.