---
title: Denmark CPR register: ~8.8M records accessed via Pays ApS accounts protected by weak/leaked passwords | ctxsec
url: https://ctxsec.com/items/denmark-cpr-pays-breach
description: ""
status: "confirmed (CPR admin + Pays via Danish press)"
published: 2026-10-12
---

> 

[← Cybersecurity News](/news) · [markdown](/items/denmark-cpr-pays-breach.md)

confirmed (CPR admin + Pays via Danish press)

2026-10-12

### Denmark CPR register: ~8.8M records accessed via Pays ApS accounts protected by weak/leaked passwords

Denmark's CPR administration confirmed a serious incident in which unauthorized parties abused a company's authorized CPR search access. Pays ApS (Odense) confirmed its access was misused. Danish reporting (TV 2 / Politiken) says at least one account used the password `123456` (a leaked former-employee credential), and that about 14 million automated searches ran roughly Sept 11–20, exposing names, addresses and CPR numbers for about 8.8 million people (~5.5M living / ~3.3M deceased per Politiken). Access was shut down Oct 2 after an unusually large invoice flagged the activity. Lesson for anyone with government-register API access: reject weak passwords, require MFA, and alert on anomalous search volume.

Sources: [Malwarebytes (summary of TV 2 / Politiken / CPR)](https://www.malwarebytes.com/blog/news/2026/10/how-123456-became-the-key-to-almost-9-million-personal-records) · [The Register](https://www.theregister.com/security/2026/10/13/123456-password-linked-to-denmark-data-breach-affecting-88m-people/5302726)