`123456' password used in Danish CPR data breach
- ID
- 34050
- Status
- summarized
- Published
- 10 Oct 2026, 5:51 PM
- Fetched
- 10 Oct 2026, 11:54 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://cphpost.dk/2026-10-10/news/round-up/123456-password-used-in-massive-danish-cpr-data-breach/
- Source URL
- https://hnrss.org/best
Summary
- Score
- 5.5
- Created
- 10 Oct 2026, 11:54 PM
- Tags
- Audience
- developerssaas_foundersvibe_coders
What happened
Politiken reports that at least three accounts at Pays ApS, a Funen-based IT company with two employees as of July 2026, used the password "123456" — including the administrator account — when hackers gained access to Denmark's CPR civil registration register. Access ran from 10 September for 21 days and 17 hours, exposing data linked to around 8.8 million CPR numbers; the hacker told Politiken they first got in with a leaked password from a former employee of a small Danish company, then wrote two programs to pull and store the data externally. Pays ApS managing director and owner Sophie Laursen confirmed to TV 2 that the company's legal access to search the CPR system had been abused, and Aarhus University professor Jens Myrup Pedersen called the password security "hopeless".
Why it matters
The lesson is about third-party privileged access, not the password itself: a two-employee vendor held search access to a national register of 8.8 million people, and the intrusion went unnoticed for 21 days and 17 hours. If your product or startup gives integrators, agencies, or contractors any access to customer data, verify those accounts have MFA and a breached/common-password blocklist, log and alert on their queries, and scope access to only the fields they legitimately need. The text contains no Malaysian or Southeast Asian angle, so treat this as a vendor-access design lesson rather than local news.
Discussion angle
A 2-person vendor held admin access to 8.8M records and nobody noticed for 21 days — what would your access logs show if one of your smallest integrations went rogue, and would you even be able to see it?