What happened?
Denmark's national civil registration system, CPR, was breached and 8.8 million records were illicitly retrieved, authorities confirmed. The person claiming responsibility said they accessed the system through an IT and data services company, and that one of the accounts they breached was protected only by a "123456" password.
How it was discovered
Copenhagen confirmed the breach. An official said it was only discovered 12 days later when an invoice revealed an unusual amount of activity from the company. The government did not name the company, but Pays ApS managing director Sophie Laursen confirmed the hacker used the company's database access to exfiltrate the data.
Why it matters
CPR holds information on virtually every Danish citizen. Such a system would be expected to require at least a more complex password, if not two-factor authentication, yet the breach happened through a third-party account's weak password — showing a system's security is only as strong as its weakest link. The hacker said they do not intend to sell or leak the information.
Similar incidents
This is not the first case exposing gaps in government database protection. In 2024, Indonesia realized it had no backups when a ransomware attack affected over 230 public agencies. Last year, South Korea lost 858 terabytes of data after a fire at a government data center.
