Danish authorities reported a data breach involving CPR numbers was possible because the system used the weak password '123456'.

"Danish CPR data breach used '123456' password" — Hacker News (best) · AI & Technology

10 Oct 2026

What it means

Danish authorities say a breach of the (Central Person Register) was possible because at least three accounts at the Funen-based IT company Pays used the password “123456,” allowing a hacker to access personal data tied to roughly 8.8 million records — more than 5 million living Danes and about 3 million deceased. The incident, disclosed on 5 October 2026, is being described as one of the largest exposures of Danish personal data, though some specifics still rest on the anonymous hacker’s own account.

Accuracy & sourcesGrounded

The core claim — that a weak password enabled access — traces to Danish authorities’ disclosure and to an anonymous hacker’s account given to Danish media, relayed by the Ritzau wire and covered by Copenhagen Post and databreaches.net. That is a reputable secondary report of a named primary source, but the attacker’s narrative and the final number of affected records are not independently confirmed.

How new

Current reporting from 10 October 2026 on a breach disclosed just days earlier on 5 October 2026; no recirculation year is indicated.