A Two-Person Software Outfit Holds the Keys to National Citizen Records
Starting September 10, 2026, an attacker armed with the trivial password “123456” logged into Denmark’s central population registry. Over the next 21 days and 17 hours, they extracted roughly 8.8 million citizen records. Denmark’s total population stands at around 6 million—meaning the leak swept up virtually every living resident, along with Danish expatriates and deceased citizens.
As news broke, nearly a million Danes rushed to place fraud alerts on their credit profiles to protect against identity theft. Public scrutiny instantly fixated on the absurd “123456” credential, mocking the embarrassing lapse. Yet the collective ridicule overlooked a far more dangerous reality: that account should never have held unrestricted power to query the entire country’s civil registry in the first place.
The springboard for the attack was Pays ApS, a private software development firm based in Odense. According to Denmark’s Central Business Register (CVR), the company listed just two registered employees as of July 2026. Yet this two-person outfit held a fully authorized, direct query interface to Denmark’s Central Person Register (Det Centrale Personregister, or CPR).
Established in 1968, CPR assigns every Danish resident a unique, lifelong identification number. Under Danish regulatory arrangements, private enterprises and industry trade bodies can obtain query credentials if they demonstrate a legitimate business need, such as verifying customer addresses. This design opened sensitive public infrastructure to the private market—while outsourcing security entirely to the technical discipline of small third-party contractors.
Figure: Data from Denmark’s Central Person Register extracted without authorization, affecting living and deceased residents alike. Source: SecurityWeek
Scraping Undetected for 21 Days: An API Blind to Abuse
Credentials reviewed by Danish daily Politiken revealed that at least three internal accounts at Pays ApS used the password “123456,” including an account with top-level administrative privileges. Jens Myrup Pedersen, professor in the Department of Electrical and Computer Engineering at Aarhus University, remarked that such a configuration was tantamount to leaving the front door wide open: anyone running a standard public dictionary of weak passwords could break in within seconds. In professional security terms, he noted, one could hardly conceive of a worse posture—system compromise was purely a matter of time.
The breach required no zero-day exploits or sophisticated tradecraft. The attacker initially acquired a former employee’s credentials from an earlier third-party breach, then pivoted through the network until finding the unprotected administrator account. Once inside the backend, the hacker deployed two automated extraction scripts to download records methodically, storing them on an overseas server.
The exfiltration ran uninterrupted for 21 days and 17 hours, encountering zero security resistance. The anonymous hacker confirmed to media outlets that the data was downloaded solely for storage, with no plans to sell or publish it. Yet for an API handling national citizen privacy, three weeks of relentless batch extraction triggered neither anomalous traffic alarms nor automated rate-limiting thresholds.
This total silence exposed a gaping hole in behavioral auditing. When an API relies exclusively on credential secrecy without throttling or anomaly detection, it loses the ability to distinguish between a legitimate routine query and a catastrophic bulk extraction once credentials are compromised.
Fixating on Weak Passwords Masks the Core Flaw: Privilege Creep
Public commentary readily laid all blame on the comical password, dismissing the incident as a farce of poor security hygiene. A strong 16-character password might have repelled this particular intrusion. But stronger passwords only raise the bar for credential stuffing; when account privileges lack boundaries, the systemic vulnerability remains untouched.
Pays ApS was initially granted access to the CPR database solely to verify address changes for members and customers. In practice, however, the system handed this micro-business virtually unconstrained search privileges across the entire database. Empowering a two-person team with queries across millions of sensitive citizen files represents a catastrophic mismatch in access granularity.
The CPR number is the foundational pillar of Danish civic life. It serves as the single universal identifier linking citizens to every public and private service—from hospital care and bank accounts to apartment leases and municipal registrations. That universal utility explains why nearly a million residents immediately froze their credit: no one can guarantee leaked CPR records will stay out of underground markets.
Figure: Physical Danish sundhedskort health insurance card, prominently featuring the unique lifelong CPR number. Source: Wikimedia Commons
Why Multi-Factor Authentication Stalled Across Public Systems
The administrator account at the center of the breach relied on a primitive weak password and had no two-factor authentication (2FA) enforced. To mainstream security practitioners, exempting an administrative gateway to core national data from secondary verification is inexplicable negligence. Plaintext credentials were all an outsider needed to walk straight in.
The revelation sparked fierce debate across technical communities. Engineers questioned why regulatory bodies never mandated multi-factor authentication for every third party interfacing with CPR. Others pointed to real-world friction in public administration: in Denmark, a notable segment of vulnerable citizens and elderly residents do not use smartphones and rely on public library computers for digital civic tasks.
Rolling out mandatory smartphone apps or hardware tokens often brings substantial onboarding overhead and operational resistance across municipal desks. Local agencies and partner institutions repeatedly cited staff retraining burdens to delay security overhauls. What began as well-intentioned accessibility accommodations for vulnerable groups ended up being leveraged up the chain, translating into systemic security concessions for commercial third-party integrations.
A Broken Security Chain: Handing Out Keys Without Ongoing Audits
Sophie Laursen, director and owner of Pays ApS, confirmed in an interview with Danish broadcaster TV 2 that the company had suffered a cyberattack and that its legitimate CPR query access was abused by an intruder. She emphasized that the attacker exploited credentials legitimately issued to the company. Notably, prior security audits had recommended improvements before the breach occurred, but those recommendations were never operationalized.
Access management must be a continuous lifecycle comprising onboarding, scoping, continuous monitoring, and timely revocation. When a state agency issues high-privilege API credentials to commercial vendors without periodic re-certification, authorization degrades into a permanent, unsupervised backdoor. Former employees’ credentials linger, unmonitored admin privileges sleep behind weak passwords, and oversight evaporates the moment credentials are handed out.
Reducing this disaster to “never use 123456 as a password” conceals the fundamental systemic breakdown. If a nation’s civil registry relies on the voluntary diligence of two-person contractors to pick strong passwords, and if high-volume API consumption goes entirely unmonitored, complex passwords will only postpone the inevitable. Defining strict access boundaries and enforcing dynamic privilege review are the only viable defenses for citizen privacy.
Reference Links:
- The Copenhagen Post coverage
- Politiken investigation
- TV 2 news report
- SecurityWeek report
- Hacker News discussion (item?id=50031269)
