Data from the Danish Central Person Register (CPR) was accessed through Pays ApS's authorized portal. Danish authorities have confirmed the data breach; reportedly, approximately 8.8 million records were affected, involving about 5.5 million living individuals and 3.3 million deceased individuals.
Pays ApS is a Danish IT and data services company authorized to access the CPR to verify customer records, including updating addresses and identifying deceased individuals. Danish authorities confirmed that someone abused a company's legitimate access rights to obtain names, addresses, personal identification numbers, and other information. Pays ApS subsequently confirmed that its access rights had been exploited.
The person claiming responsibility for the intrusion told the Danish media outlet Politiken that an account using the password "123456" allowed them to enter the system, and claimed they had no intention of selling or leaking the obtained information. Politiken reported that at least three Pays ApS accounts used this password, including an administrator account. Malwarebytes stated that the initial access reportedly involved passwords leaked by a former current affairs employee. These claims regarding the method of intrusion and the perpetrator's intent cannot yet be equated with the data acquisition incident confirmed by authorities.
According to documents obtained by the Danish television station TV 2, the attacker gained access on September 10 and conducted approximately 14 million automated queries between then and September 20. On October 2, a bill showing abnormally high activity levels led to the discovery of the incident.
The CPR administration stated that the names and addresses of registered individuals with special name and address protection were not exposed. The agency has revoked Pays ApS's access, notified the Danish Data Protection Agency, and confirmed that the police are investigating.