A person claiming responsibility for the breach of Denmark's Central Register of Persons (CPR) says they got in through an account at the IT and data services company Pays ApS that was protected by the password '123456'.

According to The Register, Danish broadcaster TV 2's documents show the attacker gained access on September 10 and ran 14 million automated searches over the next ten days.

Pays' managing director Sophie Laursen confirmed on October 9 that the company's authorized access to the CPR system had been exploited. Pays had used that access to validate business customers' records.

The Register reports that at least three Pays accounts, including an administrator account, used the same '123456' password, and that Pays' website has since been taken offline. The hacker told the Danish outlet Politiken they have no intention of selling or leaking the data.

Tom's Hardware notes the intruder would not have needed AI-assisted tooling to defeat a credential this weak.

According to The Register, the Danish government confirmed on October 5 that a breach affecting information on 8.8 million people had occurred, saying a Danish company's legal access to the CPR system was abused.

The intrusion was detected on October 2 — twelve days after the last reported searches — when a ministry staffer noticed an invoice showing unusually high activity from Pays, ministry director Mikkel Leihardt told reporters.

The data protection authority Datatilsynet was notified on October 4, and the government disclosed the attack the following day.

The CPR holds roughly 11 million records covering virtually every Danish citizen, including deceased people and those who have moved abroad, so the compromise touches addresses and personal identifiers at national scale.

Tom's Hardware frames it as a lesson that a system's security is only as strong as the weakest link, arguing users with access to such data should at minimum require complex passwords, if not two-factor authentication.

It also places the incident alongside prior government data failures, including Indonesia's 2024 ransomware attack that affected over 230 public agencies and South Korea's loss of 858 terabytes in a data center fire.

A top comment on the Tom's Hardware story argues the service exposed by the government was always designed to sell citizens' information to paying companies — for example, banks refreshing customer addresses — so the hack was really against the small firm Pays, which was entitled to pull the records as long as it paid the fees.

This debate over responsibility — third-party gateway versus state system — is a core unresolved question of the incident.

Tom's Hardware reports it expects the Danish government to overhaul its password policies in the near term, especially as AI makes attackers more efficient — recent incidents like attacks on South Korean banks and the Taiwanese government were reportedly conducted with AI agents, and hackers also breached OpenAI using Claude tools.

Readers should watch for mandatory multi-factor authentication on CPR access, scrutiny of third-party data resellers, and potential regulatory action from Datatilsynet.