World’s worst password “123456” linked to breach of 8.8M Danes

A password that has topped lists as the world’s most common and most insecure for years was reportedly to blame for a breach that gave hackers access to identification numbers belonging to nearly 9 million people in Denmark.

At least 3 accounts at Pays ApS, a small Danish IT company, are linked to a major breach of the country’s civil registration system. Denmark’s Central Business Register listed Pays ApS as having just 2 employees as of July 2026.

The compromised access allegedly allowed a hacker to retrieve information associated with approximately 8.8 million Danish Central Person Register (CPR) numbers, potentially exposing personal data on a substantial share of Denmark’s population.

Reportedly, the company’s admins used the password “123456,” a password ranked as the most common and least secure password in the world.Such a password was not supposed to be used on systems that can access public infrastructure, as “123456” is among the first passwords an attacker would try when attempting to break into an account.

Pays ApS confirms breach that led to the exposure of CPR numbers

Pays ApS, based in Odense, confirmed to Danish broadcaster TV 2 on Friday that it was the company whose access to the CPR register had been compromised.

“We can confirm that we are the company that has been subjected to an attack where our legal access to search for information in the CPR system has been abused,” managing director and owner Sophie Laursen said in an email to TV 2, according to Copenhagen Post.

An anonymous hacker told Politiken on Thursday that they were responsible for the attack and claimed that gaining access had not been particularly difficult.

According to the hacker’s account, the intrusion began with a leaked password belonging to a former employee of a small Danish company.

The attacker allegedly used that access to reach the CPR system and then created 2 computer programs to retrieve information and store it outside the register. The hacker told Politiken there were no plans to sell or publish the information.

The reported access lasted 21 days and 17 hours, beginning on September 10th.

Why could a company with 2 employees have access to an entire population’s data?

CPR is the country’s central civil registration database. It contains information on approximately 11 million registered individuals, including current residents, those who have moved abroad, and deceased individuals.

CPR numbers are widely used to identify people in dealings with public institutions and private organizations.

Multiple organizations can receive authorized access to certain register information when verifying customers’ addresses or maintaining membership records.

That arrangement allows organizations to perform routine administrative tasks without manually collecting every detail from individuals.

But it also means the security of the register depends, in part, on the security practices of the organizations permitted to query it.

What does the breach mean for Danish citizens?

Despite the massive scale of the breach, which affected nearly the entire population of Denmark, attackers may not have direct access to citizens’ digital identities.

Denmark relies heavily on MitID (2-factor authentication), so exposing a CPR number alone is not sufficient to impersonate someone.

However, CPR numbers can be exploited in social engineering and phishing attacks to craft more convincing messages. Also, there is a danger that cybercriminals can cross-reference data with previous breaches to create more accurate profiles of potential victims.

Danish authorities have warned citizens to be particularly cautious about unsolicited text messages, phone calls, and emails that contain personal information or appear to come from legitimate organizations.

People should avoid sharing passwords, one-time authentication codes, or other sensitive information in response to these bogus requests.