# Weak Password Linked to Massive Breach of Danish Population Registry Compromised partner credentials exposed personal data belonging to 8.8 million Danish citizens. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-10-13 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/10f620b3-1f89-41ed-8009-c36e269fb22b ## Critical Population Registry Compromise A major cyber incident struck Denmark's Central Register of Persons (CPR), exposing records of 8.8 million individuals out of roughly 11 million total entries. The registry stores vital personal data, including historical files of deceased citizens and expatriates. Danish authorities officially confirmed the unlawful data exposure on October 5. ## Trivial Credential Exploitation The individual claiming responsibility stated access was obtained using the basic password '123456'. Danish newspaper Politiken reported that at least three corporate accounts, including an administrator profile, shared this weak credential. The intruder asserted they had no intention of distributing, leaking, or monetizing the compromised registry records. ## Third-Party Vendor Involvement The breach originated through legitimate API access assigned to Funen-based firm Pays ApS. Managing director Sophie Laursen confirmed on October 9 that their authorized gateway was exploited. The company historically utilized CPR data to validate customer records. Following the incident disclosure, Pays took down its official business website entirely. ## Mass Automated Data Harvesting Internal documents revealed the attacker secured initial system access on September 10. Over the following ten days, approximately 14 million automated search queries were executed against the CPR database. The exfiltration activity ceased on September 20, remaining unnoticed by automated monitoring tools while querying millions of public citizen profiles. ## Belated Anomaly Detection The intrusion went undetected until October 2, twelve days after active querying ended. Discovery occurred manually when an education ministry staff member reviewed a vendor invoice showing extraordinarily high transaction volumes from Pays. This administrative billing check prompted immediate technical scrutiny, revealing widespread illegitimate activity across external API access points. ## Formal Regulatory Notification Following internal verification, authorities alerted the Danish data protection agency, Datatilsynet, on October 4. The government published a public notice the next day detailing the breach scope. Higher education ministry director Mikkel Leihardt addressed media inquiries, though officials declined to comment on specific authentication vulnerabilities at vendor endpoints. ## Vendor Security Governance Risks This incident illustrates severe systemic risks tied to third-party integration architectures. When external suppliers maintain administrative rights without enforcing robust multi-factor authentication or complexity rules, central databases face severe exposure. Even verified partner connections can bypass standard perimeter protections if credential hygiene and operational audits remain inadequately enforced. ## Operational Visibility and Rate Limiting The delay between automated exfiltration and billing-based detection emphasizes critical architectural deficiencies. High-volume database integrations require automated anomaly detection, real-time rate limiting, and dynamic query threshold alerts. Relying on monthly financial invoices rather than real-time telemetry leaves critical infrastructure vulnerable to massive data harvesting attacks by external actors. ## Sources covering this story - https://www.theregister.com/security/2026/10/13/123456-password-linked-to-denmark-data-breach-affecting-88m-people/5302726 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._