Hacker Accesses Entire Danish Population Database Using Simple Passwor

Hacker Accesses Entire Danish Population Database Using Simple Password

A hacker exposed personal information for about 8.8 million people in Denmark by using the password 123456 to breach the national population database.

NationPulse Desk

Oct 20, 2026 · 12:47 PM 2 min read

Key takeaways

A hacker used the password 123456 to breach Denmark's national population database.

The breach exposed personal data for roughly 8.8 million people.

The attacker ran about 14 million searches over 10 days in September using automated scripts.

A government employee noticed unusual activity on October 2 through an invoice.

Police have not named or arrested any suspects so far.

A hacker breached Denmark's national population database by using the password 123456, exposing personal information belonging to approximately 8.8 million individuals, which exceeds the nation's living population of about six million.

The intruder took advantage of authorized access held by Pays ApS, a private Danish firm permitted to look up specific persons within the Central Person Register. The perpetrator explained to the newspaper Politiken that three separate corporate accounts relied on the password 123456. TV 2 reported that the hacker created two automated programs and executed roughly 14 million queries across a 10-day period in September.

The Central Person Register contains around 11 million files overall, encompassing records for individuals who have died or left the country. Compromised details feature complete names, residential addresses, and Central Person Register numbers. Because these numbers are used in banking, healthcare, and taxation systems throughout Denmark, security specialists caution that the breach may enable phishing attacks, financial fraud, and identity theft.

An employee within the government spotted strange behavior on October 2 via a billing document indicating excessive query activity. The digital affairs minister of Denmark described the event as an extremely serious incident. Officials disabled the access of Pays ApS and informed the Data Protection Agency on October 4, followed by a public government confirmation of the security breach the next day.

The perpetrator later contacted news organizations to state they had no intention of leaking or selling the information, expressing deep surprise at the weakness of the security measures. The involved firm shut down its website soon after the story became public, while law enforcement has not identified or detained any suspects at this time.

Questions and answers

How did the hacker access the database?

The hacker exploited a private Danish company's legitimate access to the Central Person Register after finding that at least three company accounts used the password 123456.