Denmark CPR breach: firm scored 1/10 after weak security

A Danish IT security expert rated an Odense company’s security 1 out of 10 after a report that an employee password was “123456” and two-factor authentication was not used. The company held lawful access to Denmark’s CPR register, and an attacker accessed 8.8 million CPR numbers through that access. The story is based on local Danish broadcasters’ reporting describing the breach and the company’s response.

What happened

According to Danish media, an IT security expert assigned a score of 1/10 to the security of a small Odense company involved in Denmark’s CPR data breach. The breach reportedly occurred because an employee password was “123456” and two-factor authentication (a second verification step) was not used. The company reportedly had lawful access to search the CPR (the Danish national population register) and its access was allegedly misused by an attacker, leading to the exposure of about 8.8 million CPR numbers. The company involved has been identified as Pays, based in Odense, which confirmed to a broadcaster that it was the target. The reporting indicates that the password weakness and lack of two-step verification were central points in the incident.

Who is affected

The incident concerns personal data from the Danish CPR register. CPR numbers are unique identifiers used in Denmark for residents’ official records. The exposed data could, in theory, be used for identity verification or fraud. The report does not specify individual names of anyone affected, but it notes the number of CPR records affected (8.8 million) and emphasizes concerns about data security in access to the CPR system.

Practical next steps

What the public can consider: (1) If you are a resident whose CPR number might have been exposed, monitor official channels for notifications or guidance from authorities. (2) Be aware of phishing or identity-theft attempts that could target CPR data. (3) For organizations handling sensitive identity data, review security basics: strong unique passwords, multi-factor authentication (two-step verification), and regular security audits. (4) If you manage a database with sensitive personal data, ensure access controls restrict who can query the data and log access for auditing. (5) Stay updated with statements from Danish authorities or the broadcaster reporting on the incident for any recommended actions or remediation steps.

Limits and questions

Most of the information comes from Danish media reports and a single IT expert’s assessment. The source mentions a password of “123456” and no two-factor authentication, but it does not provide technical details about the breach method, length of exposure, or whether other security measures were in place. For readers, this means findings should be viewed as reported by media outlets rather than as a formal, public safety statement. If you seek more clarity, watch for official investigations or statements from the CPR register administrators and the company involved.

Information and responsibility notice: This article is general information based on the cited material available when published. It is not legal, tax, immigration, medical, financial, banking, or investment advice; it does not create a professional-client relationship; and it is not a guarantee of outcome, availability, accuracy, or eligibility. Rules, schedules, prices, and third-party information can change. Confirm material decisions with the relevant authority and an appropriately qualified adviser before acting.