Danish data breach raises questions over password 123456
New reports link a weak access code to a breach in which data from the central population register was accessed.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
At least three user profiles at the Danish company Pays are believed to have used the password ‘123456’ during a major data breach, including an administrator account. It has not been established whether that code was also the actual entry point to the central population register.
The Danish authorities previously announced that unauthorised parties had accessed data from the CPR register through the legitimate access of a private company. The register contains the names, addresses and personal identification numbers of around 8.8 million registered people, including people who have died or moved abroad.
New reports by Golem and the Danish news agency Ritzau, based on research by Politiken, say that at least three profiles at Pays used the code ‘123456’. One of those profiles is said to have been an administrator account. Pays has confirmed that its legitimate access to the CPR register was misused.
The combination of the weak code and access to sensitive government data is attracting considerable attention, but the technical chain of events is not yet fully known. There is no independent confirmation that an attacker guessed, cracked or directly used the code to gain entry.
According to the reports, an unknown person had access to the register for a total of 21 days and seventeen hours from 10 September. The CPR administration noticed unusual behaviour on 2 October and suspended the access of the company concerned. The police and the Danish regulator are investigating the case.
The Danish government says that the unauthorised access did not concern the names and addresses of people with protected registrations. It did, however, involve a very large number of personal identification numbers. Unlike a password, such numbers cannot easily be replaced, meaning the case also raises questions about the use of personal identification numbers as a means of identification.
The incident also shows that risks do not lie solely with government servers. Private companies can, under certain conditions, gain access to parts of the CPR register. Controls must therefore also cover access rights, logging, strong authentication and the timely detection of an unusually large number of queries.
The Danish authorities have not yet published a definitive reconstruction and no perpetrator has been identified in the public information. The password is therefore a serious security warning, but not a proven explanation for the data breach as a whole.
For Dutch organisations, the access arrangement is particularly relevant: sensitive government data can be accessed through an external party. The Danish case does not prove that the same error was made in the Netherlands, but it does show why oversight of third parties must be part of digital security.
One story, several perspectives
What is established
- Unauthorised parties used a private company’s legitimate access to the CPR register.
- Around 8.8 million registered people were involved.
- Media report that three profiles used 123456, but the route of entry has not been established.
- The Danish authorities are investigating the case.
Left
Arguments From this perspective, a large government register should be accessible through private parties as little as possible. If access is necessary, the state and companies must share responsibility for strong security and active oversight.
Values Privacy, public oversight and protection against power imbalances.
Consequences Stricter restrictions may reduce the risk, but could slow legitimate services and data sharing.
Centre
Arguments The institutional solution is risk-based access: strong authentication, data minimisation, extensive logging and independent audits of suppliers. The password incident should be investigated without pre-empting guilt.
Values Proportionality, accountability and legal certainty.
Consequences Greater oversight and technical requirements cost money, but can help detect and limit large-scale incidents earlier.
Right
Arguments From this perspective, primary responsibility lies with the private supplier that was given access to state data. Companies managing such systems must demonstrably meet high security standards and be capable of being held liable quickly in cases of negligence.
Values Individual responsibility, market discipline and consequences for inadequate security.
Consequences Liability can accelerate investment in security, but excessive risks could drive small suppliers out of public services.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The scale and route through legitimate company access have been confirmed by the Danish government. The information about the password is presented as media reporting, and the uncertainty about the actual route of entry remains explicit.
- confirmed Unauthorised parties gained access to data from the Danish CPR register through a private company. — The Danish CPR administration describes this in its statement. source
- confirmed Around 8.8 million registered people were involved. — The Danish authorities give this figure. source
- confirmed At least three profiles at Pays used the password 123456, including an administrator account. — Ritzau and Golem report this as the outcome of media reporting. source
- confirmed It has not been established that 123456 was the actual entry point to the register. — Golem explicitly states that the technical link has not been confirmed. source
- confirmed According to reports, the access lasted 21 days and seventeen hours. — This duration is mentioned by Golem and Ritzau. source
- confirmed The CPR administration noticed unusual behaviour on 2 October and suspended the company’s access. — The official Danish statement mentions 2 October and the suspension of access. source
Editor's note
The Danish government confirms the data breach and its scale, while Golem and Ritzau report the weak passwords. The link between ‘123456’ and the actual route of entry has explicitly not been proven.Sources
- Omfattende uautoriseret adgang til borgeres CPR-oplysninger — Forsknings-, Uddannelses- og Digitaliseringsministeriet
- Angriff auf dänisches Melderegister: Zugangspasswort war offenbar 123456 — Golem.de
- Medie: Tre profiler hos virksomhed i datalæksag brugte koden 123456 — DK Nyt / Ritzau
More on this in Dutch media
- RTL Nieuws — „cybersecurity datalek”
- FD — „cybersecurity datalek”
- Trouw — „cybersecurity datalek”