Somebody spent weeks quietly searching Denmark's national population register through a door that was supposed to be there. By the time the activity was noticed, the names, addresses and CPR numbers of about 8.8 million people had been exposed, a figure that covers living residents, emigrants and the deceased.
Denmark's Ministry of Research, Education and Digitalisation disclosed the incident on 5 October in an official statement, saying the CPR administration had identified a serious security incident. The CPR number is Denmark's personal identification number, used across banking, healthcare, tax and almost every public service, so the register sits close to the centre of daily life in the country.
No hacking of the register was needed
According to the ministry, the unauthorised party did not break into the CPR system itself. It misused the lawful search access granted to a private Danish company and stayed within the data that private companies are permitted to see. The register holds roughly 11 million records, so the exposure reaches about four in five of them. The ministry said people registered with name and address protection were not included in what was accessed.
The ministry said irregular activity first appeared in September, and that the CPR administration became aware of it on the evening of Friday, 2 October, establishing the scope over that weekend. The company's access has been cut off, the incident has been reported to the Danish Data Protection Agency (Datatilsynet), and police are investigating. The ministry stressed that the investigation is at an early stage, that the perpetrator is not yet known, and that its figures may change.
A six-digit password and a very large bill
The government has not named the company. In an analysis of the breach, Malwarebytes reports, citing Danish reporting, that the access belonged to Pays ApS, an Odense-based IT firm offering address updates and so-called CPR cleansing to its customers, and that the attacker reportedly logged in with a leaked password tied to a former employee. That password was reportedly 123456. These details have not been confirmed by the authorities.
Malwarebytes adds that the access stayed open for 21 days before it was shut on 2 October, although the suspicious activity appears to have stopped on 20 September, and that it came to light only because an unusually large bill for around 14 million searches drew attention. By its account, the stolen records split into roughly 5.5 million living and 3.3 million deceased people. As Malwarebytes puts it, the weak password is remarkable, but the failure to spot millions of unusual searches made the breach worse.
Expect scams that already know your CPR number
For Danes, the immediate risk is convincing fraud. The ministry urged people never to give out passwords or other confidential information by phone or email, even when the caller appears to know their name, address and CPR number. Guidance is available at sikkerdigital.dk, and Denmark's Cyberhotline (+45 33 37 00 37) has extended its hours to 8:00 to 24:00 for the coming days. Minister Christina Egelund has ordered a thorough security review of the CPR system.
For any organisation that hands third parties programmatic access to sensitive data, the lessons are blunt: reject weak passwords outright, make multi-factor authentication mandatory on every account with that access, revoke credentials when staff leave, and alert on query volumes rather than waiting for the invoice. A legitimate account doing illegitimate things is the hardest intrusion to see, which is exactly why volume monitoring matters. More context on the country's cyber posture is on our Denmark profile.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.