# Denmark's National Registry Breached via Third-Party Credential Misuse Unauthorized access to 8.8 million records highlights critical vulnerabilities in third-party system integrations. - **Source:** [Latest news RSS](https://feeds.ibtimes.co.uk/feeds/bhsz8.rss) - **Published:** 2026-10-15 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/bc617769-6baf-4934-8bdb-0f5ee0490d0d ## National Registry Data Exposure Denmark's Central Person Register, containing 11 million records, suffered a major security breach affecting 8.8 million individuals. The compromised data includes names, addresses, and unique 10-digit CPR numbers. Authorities confirmed the unauthorized access occurred through a third-party company's legitimate portal, though they have not verified the specific technical methods used by the attacker. ## Third-Party Access Vulnerability The breach originated from the misuse of a private company's authorized access to the registry system. Danish authorities allow specific companies to query information for legitimate purposes, provided they identify individuals in advance. In this incident, the attacker exploited this existing legal gateway to extract massive volumes of sensitive personal data from the government database. ## The Role of Weak Credentials An anonymous individual claimed responsibility, alleging they used a former employee's credentials to infiltrate the system. Reports suggest that at least three accounts at the involved company, including an administrator profile, utilized the insecure password '123456'. This highlights a catastrophic failure in basic credential management and authentication protocols within the third-party organization's infrastructure. ## Detection via Billing Anomalies The intrusion was discovered only after a CPR administration employee flagged an unusually high invoice linked to the company Pays ApS. Investigations revealed approximately 14 million automated searches were performed within a ten-day period. This billing spike served as the primary indicator that the system was being subjected to large-scale, unauthorized data extraction scripts. ## Attacker's Perspective on Security The alleged attacker expressed shock at the ease of access, comparing the registry's security to leaving plutonium unattended in a public train station. They claimed to have used two custom scripts to retrieve and store the data externally. Despite the breach, the individual stated they have no intention to sell or publish the stolen information. ## Expert Assessment of Credibility Cybersecurity researcher Emil Hørning reviewed a sample file containing CPR numbers and deemed the attacker's account credible. He noted that the described methods for bypassing security controls are technically plausible. While this assessment does not independently verify every detail of the intrusion, it underscores the significant risks posed by current third-party access governance models. ## Scope of Protected Information Not all data in the register was exposed during the incident. Authorities clarified that the unauthorized access did not include the names and addresses of individuals registered with specific name-and-address protection. The breach primarily impacted the broader population, excluding those who had previously opted for heightened privacy measures within the national system's administrative framework. ## Systemic Security Implications This incident forces a re-evaluation of how government entities manage third-party access to critical infrastructure. The reliance on external companies to query sensitive national databases introduces significant attack vectors if internal security hygiene remains poor. Future policy will likely demand stricter authentication requirements and real-time monitoring of all third-party API or portal usage. ## Sources covering this story - https://www.ibtimes.co.uk/denmark-cpr-register-breach-123456-password-allegation-1825893 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._