BREACH WATCH BRIEF High 🔑 Breach

Leaked “123456” Password Enables Access to 8.8 Million Danish CPR Records

A former employee’s password ‘123456’ was leaked and used to query Denmark’s CPR register, exposing personal data for 8.8 million citizens. The breach highlights the need for strong authentication controls and continuous monitoring to satisfy audit and trust requirements.

ADTP Breach Watch · October 12, 2026 · Malwarebytes Labs

SeverityHigh

Type🔑 Breach

ConfidenceHigh

ReportedOct 12, 2026

Government & Public Sector government registries public‑sector agencies handling citizen data third‑party IT service providers with authorized access to national registers Stolen Credentials

What happened

An attacker leveraged a leaked, weak password belonging to a former Pays ApS employee to query Denmark’s CPR system for 21 days, extracting personal identifiers for roughly 8.8 million people.

Why it matters for trust and compliance

The incident underscores the importance of enforcing robust password policies, mandatory MFA, and real‑time monitoring of privileged access—core elements of a continuous control‑assurance program.
Demonstrates the need for continuous verification that password policies and MFA are enforced across all privileged accounts.
Provides evidence of anomalous activity detection that can be logged for audit and regulatory review.

Who is affected

government registries public‑sector agencies handling citizen data third‑party IT service providers with authorized access to national registers

Recommended actions

Enforce password complexity rules and block common passwords.
Implement mandatory multi‑factor authentication for all privileged accounts.
Deploy continuous monitoring of query volumes and alert on outlier activity.
Rotate credentials for former employees immediately.
Document controls and monitoring evidence for audit readiness.

Get the Breach Digest

The incidents that matter for your vendors and your data, analysed for practitioners, in one email.