An unknown individual has gained access to the Danish Civil Registration System (CPR), which stores the personal data of the country's residents. This is reported by Tom’s Hardware.

Access to the system was obtained through the account of the IT company Pays ApS. The company had legal access to the registry to verify the data of corporate clients.

The person who claimed responsibility for the hack told the publication Politiken that they accessed the Pays ApS account using the password "123456." According to them, the same password was used for two other accounts belonging to the company.

The data of 8,8 million people has been put at risk. In total, the registry contains records on approximately 11 million individuals, including those who have died or left Denmark. The information accessed includes names, addresses, and personal CPR numbers.

The hacker stated that he has no intention of selling or publishing this data.

Danish authorities have confirmed the breach. It was discovered on October 2, 2026, although the intruder had gained access to the system as early as the beginning of September.