The strangest detail in Denmark’s biggest data breach is not the password. It is that the password worked exactly as designed.
On October 5, 2026, the Danish government confirmed that unauthorized parties had accessed personal records belonging to about 8.8 million people in the Central Person Register, the CPR system that anchors Danish civic life (The Hacker News). The register holds roughly 11 million records in total, including deceased and emigrated persons, which is how a country of about 5.9 million can produce an 8.8-million-person breach (The Register). The compromised fields were names, street addresses, and CPR numbers. The CPR number encodes your birth date, so the leak is a full identity kit minus the email.
Ten days, fourteen million queries, one invoice
Documents obtained by Danish broadcaster TV 2 put the intrusion on September 10, 2026. From that day until September 20, the attacker ran about 14 million automated searches against the register (TV 2). Nobody noticed the traffic itself. What broke the case, according to Mikkel Leihardt, a ministry director who spoke at the government’s press conference, was a staffer picking up an invoice that showed unusually high activity from a private company’s account (The Register).
The timeline that matters for defenders:
- September 10: attacker gains access through the legal channel
- September 10-20: ~14 million automated queries run
- October 2: intrusion detected, triggered by an invoice anomaly, 12 days after the last query
- October 4: the Danish data protection authority, Datatilsynet, is notified
- October 5: public disclosure
Fourteen million queries in ten days is not stealth. It went undetected because it arrived through a door that was supposed to be open.
The way in: a vendor with ‘123456’
The company at the center is Pays ApS, a small IT and data services firm on the island of Funen. It held authorized access to the CPR system to provide services like validating business customers’ records. The government did not name the firm, but Pays’ managing director Sophie Laursen confirmed on October 9 that the company’s access had been exploited; the firm’s website has since gone offline (The Register).
On October 13, Politiken reported the person claiming responsibility said the entry point was an account protected by the password “123456,” and that at least three of the company’s profiles, including an administrator account, shared that password. The same person told the paper they had no intention of selling or leaking the data (Politiken). Whether that holds is beside the point. The data left the building.
Read this next to our coverage of the Ledger supply-chain compromise and the pattern is identical: the core system was never broken, because a trusted edge was. Ledger’s firmware did not fail, a retail channel did. Denmark’s register did not fail, a vendor’s credential hygiene did. In both cases the blast radius was set not by the strength of the crown jewels but by how loosely the keys to them were copies. This is the working definition of a supply chain attack: you inherit someone else’s security budget.
Why identity data is crypto scam ammunition
Nothing in this breach touches a blockchain, an exchange hot wallet, or a seed phrase. So why write about it here? Because phishing attacks convert identity data into stolen crypto, and the conversion rate rises with the quality of the data.
A scam email that opens with “Dear user” is noise. A message that has your legal name, your street address, and a number that encodes your birth date can pass the first filter every victim applies: do they seem to know me? That is the entire mechanic of social engineering, and it is the same whether the target is a bank login or a seed phrase.
Concretely, for readers holding crypto in Denmark or anywhere this data circulates:
- MitID phishing: Denmark’s national digital identity gates banking and exchange logins. Security outlets covering the breach note that while MitID makes wholesale impersonation harder, real CPR data makes the surrounding lures far more convincing (Cybernews). Expect “verify your MitID” waves referencing your actual details.
- Exchange support impersonation: “We noticed unusual activity, confirm your withdrawal address” hits differently when the caller opens with your name, address, and birth date.
- Fake KYC pressure: a KYC pretext is a natural fit, since the scammer can claim your “registry record needs updating” using real registry-shaped data.
- SIM swap pre-staging: identity data smooths the carrier social-engineering step that precedes many SIM swap attacks.
The person behind this intrusion says they will not sell. History says data like this surfaces eventually, and the buyers are not curious.
The detection lesson: invoices before monitoring
For an operation that runs on automation, the most uncomfortable fact is that 14 million queries sailed through for ten days and the alarm was a human reading a bill. There is a crypto-side mirror here. Most wallet victims discover Drain activity not from an alert but from a balance that no longer matches expectation, days or weeks after a forgotten approval was exercised. If you hold crypto, the equivalent of the unread invoice is the approval list you have not audited: run through the wallet activity audit workflow before someone else generates the anomaly for you.
What to actually do
If you are in the affected population, or you assume your identity data is loose somewhere like everyone else should:
- Treat inbound contact as hostile by default. Anyone who contacts you first and already knows your name, address, or birth date has proven nothing except access to a database. Verify through the official app or a number you look up yourself. This is the core habit in avoiding crypto phishing scams.
- Never move assets because of a message. No exchange, no registry, no bank moves your funds because you failed to click something in time. Deadlines in unsolicited messages are the tell.
- Harden the recovery path. The seed phrase on paper in a drawer is untouched by this breach. What identity data attacks is the account-recovery layer around your exchange and email accounts. Hardware-key 2FA where offered, carrier port-freeze where available.
- For operators and teams: if a vendor can read your crown jewels with one shared password, you do not have a password problem, you have an access-architecture problem. Denmark just demonstrated the cost curve at national scale.
The breach will be remembered for “123456.” The number that should stick is fourteen million, times ten days, times zero alerts, until someone read an invoice.
Frequently Asked Questions
Was any crypto stolen in the Denmark CPR breach?
No. The breach accessed identity data: names, addresses, and CPR numbers for about 8.8 million people. No wallets, exchanges, or private keys were touched. The crypto risk is indirect and downstream: leaked identity data makes targeted phishing and impersonation scams far more convincing.
What is a CPR number and why do scammers want it?
The CPR number is Denmark's civil registration number, and it encodes the holder's birth date. Combined with a name and street address, it gives a scammer enough verified personal detail to build credible pre-texts, from fake KYC verification calls to MitID phishing, which is Denmark's national digital identity system used for banking and exchange logins.
How did a national database end up behind the password 123456?
The national register was not directly password-protected with 123456. A private company, Pays ApS, held authorized access to the register for validating business records. According to Politiken, at least three of the company's accounts, including an administrator account, shared the password 123456, and the attacker entered through that legitimate channel.
I am not in Denmark. Should I care?
Not for this specific leak, but for the pattern. Most people's identity data is already circulating from some breach somewhere. The defensive posture is the same everywhere: treat any stranger who contacts you already knowing your name, address, or birth date as potentially dangerous, and never move crypto based on an inbound message or call.