Denmark has confirmed that unauthorised users accessed names, addresses, and personal identification numbers belonging to approximately 8.8 million people in its national population register after misusing a private company’s legal access to the database.
The incident involved Denmark’s Central Person Register (CPR), which holds identity records used by public services and businesses. Authorities discovered suspicious activity on October 2, even though the unauthorised searches had taken place in September.
Then, a government statement issued on October 5 confirmed that the company’s access had been blocked and police were investigating. But further reporting has since linked the incident to an IT company whose accounts allegedly used the password “123456.”
How a Private Company’s Access Exposed Millions of Records
Under Danish law, approved companies can search certain CPR information for legitimate business purposes. In this case, the intruder used an existing connection to reach the register.
Pays ApS, an IT and data services company based on the Danish island of Funen, was identified after its managing director, Sophie Laursen, confirmed to Danish media on October 9 that the company’s authorised access had been abused. As at this time, the company only had 2 employees, according to Denmark’s Central Business Register.
According to Politiken, a person claiming responsibility said they accessed a company account using credentials linked to a former employee. The newspaper reported that at least three Pays accounts, including an administrator account, used “123456” as their password. However, authorities have not independently confirmed how the intruder obtained access.
Documents obtained by broadcaster TV 2 showed that approximately 14 million automated searches were made between September 10 and 20. And the activity was discovered on October 2 after a government employee noticed an unusually large invoice linked to the company’s searches.
Denmark’s data protection agency, Datatilsynet, said the automated searches were intended to identify valid CPR numbers.
Why 8.8 Million People’s Information Was Exposed
Denmark has around six million residents, but the CPR register contains approximately 11 million records, including people who have died or moved abroad.
Authorities said the exposed information included names, residential addresses, CPR numbers, and the ten-digit identifiers used across services such as healthcare, taxation, and banking. They, however, said the names and addresses of people registered for special protection were not included.
And the full extent of any further misuse remains unknown. The individual who claimed responsibility told Politiken they did not intend to sell or publish the information, although that statement has not been independently verified.
Denmark Orders Security Review as Investigation Continues
Digitalisation Minister Christina Egelund called the breach a “deeply serious incident” and ordered a security review of the register alongside measures intended to prevent similar incidents.
Datatilsynet has advised people to question unexpected calls, emails and text messages, even when the sender already knows personal details. The regulator warned that such information can make scams more convincing and urged people not to share passwords, card information, or PINs.
Police are still investigating who accessed the information and how the company’s login details were compromised.
For now, the case raises questions about why millions of unusual database searches were able to continue before anyone detected them.
