`123456’ password used in Danish CPR data breach
At least three accounts at the company linked to a major breach of Denmark’s CPR register reportedly used the password “123456”, including an administrator account.
At least three user accounts at the Funen-based IT company Pays used the password “123456” when hackers gained access to Denmark’s CPR register, Politiken reports.
One of them was the company’s administrator account.
The breach exposed information linked to around 8.8 million CPR numbers. The CPR system is Denmark’s central civil registration database and contains personal information on people living or previously registered in Denmark.
The newspaper Politiken reviewed data from the breach that the hacker allegedly used to gain access to the system.
Jens Myrup Pedersen, professor at Aarhus University’s Department of Electrical and Computer Engineering, described the company’s password security as “hopeless”.
“There is really no security, it is an open door. A password like ‘123456’ is one of the very first things you would guess if you took a list of common passwords,” he told Politiken.
“I find it hard to see that you could have worse security. It was a matter of time before things went wrong.”
Pays ApS, based in Odense, confirmed to TV 2 on Friday that it was the company whose access had been compromised.
“We can confirm that we are the company that has been subjected to an attack where our legal access to search for information in the CPR system has been abused,” managing director and owner Sophie Laursen said in an email to TV 2.
The hacker had access to the CPR register from 10 September for a total of 21 days and 17 hours.
An anonymous hacker told Politiken on Thursday that they were behind the attack and claimed gaining access had not been particularly difficult.
According to the hacker, access was initially obtained using a leaked password belonging to a former employee of a small Danish company. The hacker then allegedly created two computer programs to retrieve information from the CPR system and store it externally.
The hacker told Politiken that there were no plans to sell or publish the information.
Private companies and associations can be granted access to information in Denmark’s CPR register when they have a legitimate need, for example to obtain address information about customers or members.
According to Denmark’s Central Business Register, Pays ApS had two employees as of July 2026.
At least three accounts at the company linked to a major breach of Denmark’s CPR register reportedly used the password “123456”, including an administrator account.
At least three user accounts at the Funen-based IT company Pays used the password “123456” when hackers gained access to Denmark’s CPR register, Politiken reports.
One of them was the company’s administrator account.
The breach exposed information linked to around 8.8 million CPR numbers. The CPR system is Denmark’s central civil registration database and contains personal information on people living or previously registered in Denmark.
The newspaper Politiken reviewed data from the breach that the hacker allegedly used to gain access to the system.
Jens Myrup Pedersen, professor at Aarhus University’s Department of Electrical and Computer Engineering, described the company’s password security as “hopeless”.
“There is really no security, it is an open door. A password like ‘123456’ is one of the very first things you would guess if you took a list of common passwords,” he told Politiken.
“I find it hard to see that you could have worse security. It was a matter of time before things went wrong.”
Pays ApS, based in Odense, confirmed to TV 2 on Friday that it was the company whose access had been compromised.
“We can confirm that we are the company that has been subjected to an attack where our legal access to search for information in the CPR system has been abused,” managing director and owner Sophie Laursen said in an email to TV 2.
The hacker had access to the CPR register from 10 September for a total of 21 days and 17 hours.
An anonymous hacker told Politiken on Thursday that they were behind the attack and claimed gaining access had not been particularly difficult.
According to the hacker, access was initially obtained using a leaked password belonging to a former employee of a small Danish company. The hacker then allegedly created two computer programs to retrieve information from the CPR system and store it externally.
The hacker told Politiken that there were no plans to sell or publish the information.
Private companies and associations can be granted access to information in Denmark’s CPR register when they have a legitimate need, for example to obtain address information about customers or members.
According to Denmark’s Central Business Register, Pays ApS had two employees as of July 2026.
Danish motorists received almost 21,000 penalty points for using handheld mobile phones while driving last year – the highest number in four years.
Mobile phones are playing a growing role in traffic offences in Denmark.
In 2025, motorists received 20,910 penalty points on their driving licences for using a handheld mobile phone behind the wheel, according to figures from the police case management system POLSAS.
That means mobile phone use accounted for roughly one in every four of the 84,056 penalty points issued for traffic offences during the year.
The number of mobile-related penalty points increased by 7.5 percent compared with 2024 and reached its highest level in four years.
On average, police issued 57 penalty points every day for handheld mobile phone use.
Britta Bjerregaard, claims director at insurance company Alm. Brand, described the development as deeply concerning.
“Most people know full well that the phone should stay put while driving. Still, it can be tempting to just answer a call, reply to a message, or change the song,” she said.
“Traffic does not pause while you look at the screen.”
89 metres without watching the road
The Danish Road Safety Council considers inattention one of the major risks on Danish roads, with mobile phones posing a particular problem.
“The mobile phone takes an incredible amount of attention if you use it behind the wheel,” deputy director Karina Petersen said.
“If you look at the screen for four seconds at country road speed, you are driving 89 metres blind.”
However, Petersen cautioned that the increase in recorded offences does not necessarily mean that more drivers are using their phones.
The rise could also reflect more police checks or improved camera equipment used for traffic enforcement.
What are the rules in Denmark?
Using a handheld mobile phone while driving in Denmark results in a DKK 1,500 fine and a penalty point on your driving licence. An additional DKK 1,000 contribution to the Victims’ Fund is also charged.
The rule applies even when the car is stationary in traffic or waiting at a red light.
Drivers may briefly operate a phone if it is securely mounted, and using a vehicle’s built-in screen is also permitted.
The ban on handheld mobile phone use also applies to cyclists, electric scooter users and drivers of other motorised vehicles.
Minister of Defence Jeppe Bruus (S) calls a Russian TV report about the incident where a Russian frigate fired flares at a Danish military helicopter in September a “misinformation campaign”. He says this to DR. The minister says that, according to the Defence Command, part of the material does not originate from the day in question. – This confirms to me that what is underway here is a Russian misinformation campaign, which is about trying to see whether they can sow distrust in the Danish authorities, the minister says to DR. On Thursday, Russian state TV showed a report about the incident on 14 September, in which a Russian warship and a Danish helicopter were involved. According to DR, the footage shows how close the Danish defence helicopter allegedly came to the Russian warship. In the report, it is mentioned that the helicopter “intruded into the ship’s security zone”, DR writes. The firing of the two flares itself does not appear in the report from the TV channel Rossiya 1. On 14 September, two flares were fired from the Russian frigate Soobrazitelny, which was in international waters off Gedser. According to the Defence Command, one of the flares passed 10-15 metres from a Danish Fennec helicopter. According to the Defence, the firing occurred without warning in connection with a routine mission where the helicopter was taking pictures of the frigate in international waters. Russia’s ambassador to Denmark, Vladimir Barbin, has stated that the Danish helicopter acted “provocatively” in the lead-up to the firing of the flare. According to Denmark’s Minister of Foreign Affairs, Lars Løkke Rasmussen (M), the Russians will not be able to present evidence that supports this, – It does not budge our perception of that situation an iota, he said to TV 2 News in September. RITZAU
A 73-year-old man has been charged with reckless driving after he made a U-turn on the Esbjerg Motorway on Friday afternoon and briefly drove against the direction of traffic. This was stated by South and South Jutland Police in an update on the messaging service Politi Update on Friday evening. While the wrong-way driver was driving against the direction of traffic, another motorist had to make an evasive maneuver, which led to a traffic accident. No one was seriously injured, duty officer Rikke Rosenberg stated earlier in the evening. Following the incident, which occurred at 16:35 at exit 73 Korskro in South West Jutland, police appealed for witnesses. According to surveillance footage, the black car slowed down and pulled into the emergency lane on the right side of the road before turning around and driving back toward the exit. From the surveillance footage, police were able to see the car’s registration number and thereby find the owner. After the accident, the first lane was briefly closed. RITZAU
An unauthorized user had access to Denmark’s national Civil Registration System (CPR) for nearly 22 days before authorities discovered the security breach, according to documents obtained by TV 2.
The access began September 10 and was stopped October 2, lasting 21 days and 17 hours.
However, preliminary investigations suggest the unauthorized activity ended September 20, approximately 10 days after it began, according to a report submitted by the CPR office to the Danish Data Protection Agency.
The Ministry of Research, Education and Digitalization announced Monday that personal information belonging to approximately 8.8 million people had been exposed, including names, addresses and CPR identification numbers.
The breach occurred through a small Danish company with legitimate access to the register.
According to DR, the company is based on Funen and shares ownership and an address with a larger business. Its identity has not been publicly confirmed.
Authorities discovered the incident after receiving an unusually large invoice for searches conducted through the company’s account.
Approximately 14 million CPR searches had been made using its access credentials.
“The number far exceeds the company’s customer base, and the company has indicated that they did not perform the lookups themselves,” the CPR office stated in its report.
Private companies and organizations can pay to access certain CPR information.
Research, Education and Digitalization Minister Christina Egelund of the Moderates party acknowledged that security measures had been inadequate.
She has requested a security review of the register following the breach.
The company had not responded to DR’s requests for comment as of Friday morning.
Canned sardines are selling rapidly across Denmark, particularly around Copenhagen, as supermarkets report rising demand and occasional shortages.
Four major grocery retailers, Coop, Salling Group, Nemlig.com and Dagrofa, confirmed significant sales increases to TV 2 Kosmopol.
Coop, which operates 365, SuperBrugsen, Brugsen and Kvickly, reported a 170 percent increase in sardine sales in Denmark’s Capital Region between June and September 2026 compared with the same period last year.
Nationwide, Coop’s sales rose 163.5 percent.
Jacob Herbst Lassen, Coop Denmark’s press manager, said the sudden popularity has left some shelves with fewer products while purchasing teams work to replenish supplies.
Salling Group also reported pressure on availability, although spokesperson Alma Lyhne Kristensen said the company remained adequately stocked overall.
Online supermarket Nemlig.com said Greater Copenhagen and North Zealand accounted for 75 percent of its sardine sales.
Dagrofa, which operates Meny and Spar stores, reported that sales in the capital area had more than doubled compared with last year.
The surge may be connected to the social media trend “eat your skincare,” which promotes foods bel