Weak Admin Passwords Expose 8.8 Million Danish National ID Records
A Danish IT firm’s use of simple passwords allowed attackers to access millions of national identification numbers via legitimate credentials.
Key points
- The breach exposed data linked to approximately 8.8 million national identification numbers.
- Attackers used the password “123456” on administrator accounts at the IT company Pays.
- Access was maintained for over 21 days using tools to extract records from the Central Person Register.
Organisations relying on third-party vendors face significant risk when those partners neglect basic security hygiene. A recent incident in Denmark demonstrates how weak credentials at a trusted supplier can lead to the exposure of millions of sensitive national records without direct system intrusion.
How it unfolded
- Access began on 10 September when an attacker used a leaked password from a former employee of Pays, an IT firm based in Odense.
- The hacker exploited at least three accounts, including an administrator, that used the simple password “123456” to enter the system.
- Over a period of 21 days and 17 hours, the attacker used custom programs to retrieve and export personal data from the register.
Who is affected
The compromised data covers approximately 5.5 million living individuals and 3.3 million deceased persons registered in Denmark. Politiken reported that the attacker shared 8,749,975 records with the newspaper, which explains the varying figures in media coverage. The Central Person Register holds personal details for people currently living in or previously registered in the country.
Pays ApS confirmed to TV 2 that its lawful search access to the CPR system had been abused. Managing director Sophie Laursen acknowledged the attack in an email, according to The Copenhagen Post. The company had permission to search the register for legitimate business purposes, such as verifying customer addresses.
This incident mirrors other breaches where stolen vendor credentials provided a pathway into sensitive databases. The pattern resembles the Veradigm third-party data breach, where attackers downloaded patient information through an approved interface. It highlights how valid credentials from a compromised partner can bypass traditional perimeter defences.
The fix
No patch or specific technical fix has been confirmed by the vendor or authorities yet. The breach underscores the need for organisations to enforce strong password policies and monitor account activity closely. Long access windows suggest that existing monitoring controls may not have detected the unusual data collection patterns during the incident.
What to do and how to stay safe: Pays
- Review and enforce strong, unique password requirements for all administrative and privileged accounts within your organisation.
- Implement multi-factor authentication for any system that provides access to sensitive personal or national identification data.
- Monitor logs for unusual search volumes or data exports that deviate from normal business patterns to detect potential abuse.
- Regularly audit third-party vendors’ security practices to ensure they meet your organisation’s standards for handling sensitive information.
Step-by-step guide: How Common Misconfigurations Trigger Silent Data Leaks
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How did the attacker gain access to the Danish national register?
The attacker used a leaked password from a former employee of Pays, an IT company with legitimate access to search the register.
Why was the password “123456” significant in this breach?
At least three accounts at Pays, including an administrator account, reportedly used this simple password, allowing the attacker to bypass initial security.
How long did the attacker have access to the system?
Access reportedly began on 10 September and lasted for 21 days and 17 hours before the breach was identified.
