Overview
- A person claiming responsibility says they used Pays ApS login credentials to access Denmark’s Central Register of Persons after logging in on September 10 and then ran roughly 14 million automated searches through September 20.
- The CPR administration says about 8.8 million records were exposed, covering roughly 5.5 million living people and 3.3 million deceased people, and that records with special name or address protection were not included.
- Reporting and the attacker’s claim indicate at least three Pays accounts, including an administrator account, used the password "123456," and an independent researcher checked a provided sample and found it plausible.
- The intrusion was spotted after an unusually large invoice triggered a review on October 2, after which CPR revoked Pays’s access, notified the Danish data protection authority, and police opened a criminal investigation.
- Experts warn the leak of names, addresses and permanent CPR numbers raises long-term identity‑fraud risks, and officials are ordering forensic audits, tighter third‑party controls, rate limits and stronger credential practices while citizens are urged to use multi-factor authentication and watch for tailored phishing.