Denmark CPR Breach: 8.8 Million Records Pulled via Pays ApS

Executive Summary

The Denmark CPR breach exposed the names, addresses and CPR numbers of about 8.8 million people after unknown users abused the legal lookup access of Pays ApS, a small Odense company, to Denmark’s Central Person Register (CPR). The Ministry of Research, Education and Digitalisation disclosed it on 5 October 2026. The CPR administration spotted irregular activity on the evening of 2 October, shut the company out and notified the Danish Data Protection Agency (Datatilsynet). Police have named no suspect. An anonymous person has claimed the attack to the newspaper Politiken and says a leaked password was enough. People registered with name and address protection were not affected.

A Billing Run Exposed the CPR Breach

The access lasted far longer than the ten days first described. Documents obtained by TV 2 show the account was open from 10 September until it was stopped on 2 October 2026: 21 days and 17 hours. A CPR office report to Datatilsynet puts the end of the unauthorised activity at 20 September. About 14 million lookups ran through the company’s credentials and the CPR office told the regulator the volume far exceeded the firm’s customer base.

Mikkel Leihardt, a department head at the ministry, told a press briefing on 6 October that the alert came during invoicing on a Friday evening when a very large amount was billed for September. Private users pay per lookup. Datatilsynet described the activity as a very large number of automated searches aimed at finding valid CPR numbers.

Pays ApS and the 123456 Claim

Pays ApS confirmed its role to TV 2 on 9 October. “We can confirm that we are the company that has been subjected to an attack where our legal access to search for information in the CPR system has been abused,” managing director and owner Sophie Laursen wrote. The company had two employees in July 2026, according to Denmark’s Central Business Register.

On 8 October an anonymous person told Politiken they were behind the attack. By their account, a leaked password belonging to a former employee opened the company’s access before two programs pulled records and stored them outside the system. Politiken reviewed data the person supplied and reported that at least three Pays accounts, the administrator account among them, used the password “123456”. The person says the data will not be sold or published. On 13 October Politiken added the person’s claim that AI wrote the code, a bug made it search for people born in 1877 instead of 1977.

Police have confirmed none of it.

Who the 8.8 Million Include

The register holds about 11 million records including people who have died or emigrated against roughly 6 million residents. Nordic citizens who settle in Denmark get a CPR number and stay registered as emigrated after leaving, Nyheter24 reported. Swedes who once lived there may therefore be among the 8.8 million.

About 970,000 people had placed a credit warning in the CPR by 7 October up from just under 250,000 on 1 October, the ministry said. Laila Reenberg, head of Styrelsen for Samfundssikkerhed (the Agency for Societal Security), told companies and authorities on 6 October to stop treating a CPR number on its own as proof of identity.

Still Open as of 13 October

Police said at the 6 October briefing that nobody had been identified or charged over the Denmark CPR breach. The ministry says it has introduced new CPR measures without listing them and has not said whether affected people will be told individually. Pays’ director did not answer Politiken’s questions about the company’s security.

The Lookup Logs Were Already on the Ministry’s Agenda

The breach was caught by a billing run, 12 days after the activity reportedly stopped. In a memo dated 20 March 2026, Copenhagen Municipality told councillors it was working with the ministry responsible for CPR on automated follow-up of lookup logs. The trigger was a former employee who made 1,745 unauthorised CPR lookups between June 2023 and July 2024. That memo covered municipal staff, not private-company accounts. The ministry has not said whether any volume alert covered accounts like Pays’ in September, when a firm with two employees ran about 14 million searches.

References

1. Omfattende uautoriseret adgang til borgeres CPR-oplysninger
2. Orientering om CPR-sag, 20 March 2026
3. Data breach at Denmark’s national population register exposes 8.8 million people
4. Hacker retained access to Danish CPR register for nearly 22 days before breach was discovered
5. `123456’ password used in massive Danish CPR data breach
6. Suspected hacker says AI created program used in Danish CPR breach
7. Denmark’s CPR breach: 14 million lookups in ten days, found through a bill
8. Miljontals personnummer läckta i Danmark: du kan vara drabbad

This post is also available in: