A Danish IT company called Pays, based on the island of Funen, held lawful permission to search Denmark's Central Person Register (CPR), the national database of personal identification numbers.

According to CyberSecurityNews, at least three Pays accounts — including an administrator account — reportedly used the password "123456".

The Copenhagen Post reported that the attacker gained access through a leaked password belonging to a former employee of a small Danish company, then allegedly built two programs to retrieve CPR information and save it outside the system.

Access reportedly began on September 10 and lasted 21 days and 17 hours.

Politiken's investigation, cited by CyberSecurityNews, puts the haul at 8,749,975 records — which is why coverage describes the breach as either 8.7 million or roughly 8.8 million records.

Those figures cover about 5.5 million living people and 3.3 million deceased people, and should be read as approximate rather than an exact total. Politiken reports the hacker shared stolen data with the newspaper and claimed the password "123456" helped unlock access to CPR numbers and addresses.

These details are attributed to the hacker's own account, not a published forensic report.

Pays ApS confirmed to TV 2 that its lawful CPR search access had been abused; managing director and owner Sophie Laursen acknowledged the attack in an email, according to The Copenhagen Post.

Private companies can receive CPR access for legitimate needs such as checking customer addresses, meaning the security of every approved organization becomes a single point of failure for the register.

CyberSecurityNews compares the pattern to the Veradigm third-party breach, where stolen vendor credentials allowed downloads through an approved interface. The 21-day access window also raises questions about whether monitoring could catch bulk searches before millions of records walk out the door.

CyberSecurityNews notes that research into passwords used in RDP attacks puts "123456" at the top of the list, underlining how predictable passwords remain useful to attackers.

The outlet recommends blocking common passwords, unique credentials, multifactor authentication, prompt disabling of former-employee accounts, limits on records searched, alerts for unusual search volumes, and regular review of partner access.

The hacker told Politiken there were no plans to sell or publish the information, but that does not remove the privacy risk from unauthorized copies. Reporting does not establish that the data has been used for fraud.

For contrast, Zscaler's ThreatLabz 2026 Ransomware Report recorded $328 million in extortion payments, showing how valuable stolen identity data remains to attackers.