A two-person IT firm, one national ID database, and 8.8 million exposed records
Denmark’s Central Person Register holds a 10-digit identity number for nearly everyone connected to the country. On October 5, Danish authorities said intruders had misused a private company’s access to pull data linked to about 8.8 million people. Names, addresses, and CPR numbers were taken. Records with name-and-address protection were left out, according to the CPR administration.
The CPR number is the master key of Danish civic life: it follows a person to the doctor, the tax office, the bank, and the welfare system. The register holds roughly 11 million records, covering current residents, the deceased, and citizens who moved abroad. Politiken reports the material the attacker shared with the newspaper covered about 5.5 million living people and 3.3 million deceased — a breakdown of that dataset, not the ministry’s official count. The 8.8 million figure is the ministry’s preliminary count and could be revised as the investigation continues.
What authorities have confirmed
The Danish digitalisation ministry’s October 5 statement laid out the confirmed core: an unauthorized party exploited a private company’s legitimate search access and ran what it called “a very large number” of automated lookups to identify valid CPR numbers. The registry learned of it on October 2. The company involved was Pays ApS, based in Odense. Its managing director, Sophie Laursen, confirmed to TV 2 on October 9 that the firm’s access to the registry had been abused. Denmark’s Central Business Register lists Pays ApS as having just two employees as of July 2026.
The breach went undetected for weeks. Neither the vendor nor government monitors caught it. Mikkel Leihardt, a director at the Ministry of Higher Education and Science, told a press conference that a department staffer flagged an invoice showing abnormally high query charges from Pays. Documents obtained by TV 2 put the scale at roughly 14 million automated lookups. The case is with Danish police and the Danish Data Protection Agency, Datatilsynet, and digitalisation minister Christina Egelund has ordered a full security review of the system.
What only the attacker has claimed
A person claiming responsibility spoke to the Danish newspaper Politiken, and their account needs separating from what Politiken verified on its own. The attacker said they got in using a password from an old leak that belonged to a former Pays employee. Separately, Politiken’s own review of leaked data found at least three Pays accounts, one with admin rights, protected by the password “123456”. The first is the intruder’s story. The second is the newspaper’s finding.
The same person told Politiken they built two programs to pull the data and store it externally, and claimed AI assistance. Two experts who reviewed the program for Politiken — more than 40,000 characters of code — found the AI-generation claim plausible. That assessment covered the code’s apparent origin, not an independent confirmation of how many records were taken. The code also contained an error: it searched for people born in 1877 instead of 1977, so CPR numbers tied to the 1977 birth year are missing from the material shared with the newspaper. On timing, the picture is consistent across sources: the intruder had access for about 21 days and 17 hours starting September 10, while the roughly 14 million automated queries ran over about ten days, ending around September 20.
The MitID gap
The breach alone does not let someone impersonate you. Denmark leans heavily on MitID, its national two-factor authentication system, and officials advise organizations not to rely on a CPR number alone. A leaked CPR number is dangerous mainly as raw material for convincing phishing, not as a skeleton key.
Danish cybersecurity specialist Jan Kaastrup told TV 2 the deeper problem is that CPR numbers were ever treated as secrets at all, calling that approach “broken”. He argued a number alone should never count as proof of identity.
Why this pattern should worry you anyway
The attacker never broke the register. They used a trusted vendor’s legal access and pulled millions of records with automated queries while nobody watched. It is the same pattern as the South Korean bank hacks earlier this month, where intruders hit 16 financial firms through shared weaknesses. Your own Social Security number, medical records, and bank details live behind the same kind of door in the US, inside third-party vendors you have never heard of and cannot audit. The Oracle Health breach, whose nearly 20 million victim count surfaced this month, worked the same way.
Related: South Korea bank hack: 16 financial firms breached
If your data is in this breach, or one like it
- Assume your details are circulating. Names, addresses, and ID numbers fuel phishing that uses real personal details. Treat unexpected messages from your bank or government with extra suspicion, even if they use your name correctly.
- Watch for targeted phishing. A leaked ID number plus your real name and address lets scammers craft messages that look legitimate. Be skeptical of anything that uses personal details to build trust. US readers: the equivalent defense is a credit freeze at the three bureaus plus a fraud alert.
- Ignore “breach resolution” calls and emails. Scammers move fast after big disclosures. Legitimate authorities will not call asking for your ID number to “secure” it.
- Never share passwords or one-time codes. The Danish minister’s own advice to residents: ignore suspicious messages, and give no one your credentials by phone, text, or email.
How many people were really affected?
About 8.8 million, per the Danish government’s October 5 statement: names, addresses, and CPR numbers. Politiken reports roughly 5.5 million living and 3.3 million deceased from the attacker’s shared dataset. The ministry’s figure is preliminary and could be revised. People with name-and-address protection were not affected.
Did the hacker really use “123456”?
Politiken’s own review found at least three Pays accounts, one with admin rights, using the password “123456”. The attacker separately claimed they entered with a password from an old leak belonging to a former employee. Neither Danish authorities nor Pays has confirmed either account of how access began.
Will the stolen data be sold or leaked?
The person claiming responsibility told Politiken they had no intention of selling the data or making it public. That is an unverified statement from the intruder, not a guarantee. Police and the data protection agency are investigating.
Correction (October 15, 2026): Updated with Politiken’s independent “123456” finding, TV 2’s 14M query figure, the MitID context, and the 40,000-character code review. An earlier version misattributed the breach discovery and the query count.
