Danish citizen registry breached through weak password, hacker says
A hacker claims weak credentials at Pays ApS, an IT and data services company, provided access to Denmark's Central Register of Persons. The breach reportedly exposed 8.8 million records and was discovered 12 days later after unusual invoice activity. The hacker said they do not plan to sell or leak the data.
A hacker attributed access to Denmark’s CPR to an account at Pays ApS guarded only by “123456.” The intrusion reportedly yielded 8.8 million records and went unnoticed for 12 days until invoice activity looked abnormal. Pays ApS managing director Sophie Laursen confirmed the company’s database access was used to remove data; the hacker said they do not intend to sell or publish it.
The case echoes other government-data failures: Indonesia’s 2024 ransomware incident affected more than 230 public agencies and exposed missing backups, while South Korea lost 858 terabytes after a data-center fire. The source also notes AI tools are making attacks more efficient, though a trivial password would not require such assistance.
The reported exposure of CPR records could affect millions of Danish residents, whose personal details may become vulnerable to identity fraud or targeted scams if data is misused later. It may also pressure public agencies and vendors to strengthen access controls, such as stronger passwords and two-factor authentication. Because the hacker says they will not sell or leak the data, immediate harm may be limited, but trust in government data handling could still suffer.