123456 password: how 8.8 million Danish records leaked through a small vendor
On October 5, the administration of Denmark’s Central Person Register (CPR) confirmed a breach involving the names, addresses and CPR numbers, the Danish equivalent of a social insurance number, of about 8.8 million people, living, deceased or gone abroad. The attacker didn’t break into the register. They used the legitimate access of a small software company in Odense, Pays ApS, which was authorized to query the register to validate its clients’ records. And according to the daily Politiken, at least three of the company’s accounts, including the administrator account, used the 123456 password.
So the largest data breach in Danish history comes down to a small vendor, a “partner” account and six digits. It’s exactly the kind of weak link you’ll also find in a local SMB.
22 days between the first login and the alarm
Timeline of the fraudulent access (September–October 2026)
Sources: documents obtained by TV 2 and DR, Danish ministry press release. Berlingske reports total access of 21 days and 17 hours.
The most striking detail: it wasn’t an antivirus or a security alert that raised the alarm, but a CPR employee who noticed an unusually high invoice for that company. The register was alerted on October 2, the Danish data protection authority on the 4th, and the public on the 5th. On October 9, Pays’ managing director confirmed the company’s access had been abused. Police are investigating; no one has been charged so far.
The 5 missing locks behind the 123456 password
A weak password doesn’t explain everything. For the attack to succeed and last, several protections had to be missing at the same time.
Your SMB’s “key” accounts: take inventory
Pays had privileged access to a database far bigger than itself. Your business also has accounts that open important doors: to your employees, your clients, the government or your partners. Print this table and fill it in with your team, one row per account.
| Account | What it opens | Who uses it? | MFA on? | Unique password? | Alert on unusual use? |
|---|---|---|---|---|---|
| Microsoft 365 or Google Workspace admin account | All employee email, files and accounts | ☐ Yes ☐ No |
☐ Yes ☐ No |
☐ Yes ☐ No |
|
| Government portal (e.g. CRA My Business Account, Revenu Québec) | Tax files, payroll, sales tax remittances | ☐ Yes ☐ No |
☐ Yes ☐ No |
☐ Yes ☐ No |
|
| Online payroll service | SINs, addresses and salaries of every employee | ☐ Yes ☐ No |
☐ Yes ☐ No |
☐ Yes ☐ No |
|
| Domain name registrar | Your website and incoming email | ☐ Yes ☐ No |
☐ Yes ☐ No |
☐ Yes ☐ No |
|
| A client’s or vendor’s portal | Someone else’s data (like Pays with the CPR register) | ☐ Yes ☐ No |
☐ Yes ☐ No |
☐ Yes ☐ No |
|
| Cloud management software or CRM | Customer records, quotes, history | ☐ Yes ☐ No |
☐ Yes ☐ No |
☐ Yes ☐ No |
Every “No” is a missing lock. Start with the accounts that give access to someone else’s data: a leak there costs the most, in money and in reputation.
From worst to best: the password ladder
Where do your accounts stand?
123456The most common password in the world: it’s among the first guesses of any hacking tool.Laval2026!Looks complex, but follows a pattern (city + year + symbol) that tools try very early.tulip-garage-orbit-syrupA long, random passphrase: strong, as long as it’s used nowhere else.manager + MFAA unique password per account, plus a second factor: a stolen password is no longer enough.passkeyNothing to type, nothing to phish: the best option when the service offers it.In Microsoft 365, Microsoft Entra’s banned password list already blocks the most common ones, starting with the 123456 password. But MFA still has to be on for everyone, including the “service” account nobody really uses anymore.
⚖️ What about Quebec’s Law 25?
In Quebec, unauthorized access to personal information is a confidentiality incident. You must record it in your incident register and, if there is a risk of serious injury, notify the Commission d’accès à l’information and the people affected. If your vendor is the one at fault, your obligations remain: hence the importance of spelling out security measures in the contract.
The Danish CPR also points to a useful reflex: never give out a password by phone or email, even if the caller already knows your name, address and number. Stolen data is often used to make scams more convincing.
5 things to do this week
- Fill in the inventory above, noting who is responsible for each account.
- Turn on MFA everywhere, starting with admin accounts and access to government and banking portals.
- Adopt a business password manager and replace every shared or reused password.
- Check your addresses against known leaks, for example with the free Have I Been Pwned service, and immediately change any exposed password.
- Set up usage alerts: unusual logins, mass downloads, invoices that climb. Proactive monitoring of your systems spots this kind of anomaly in hours instead of weeks.
To go further: our scorecard to rate your vendors’ security, the article on phishing that bypasses MFA, and our cybersecurity services and Microsoft 365 services.
Book your free cyber check
In 30 minutes, we review your “key” accounts, MFA, shared passwords and existing alerts, and you leave with a clear list of priorities. Free, no commitment.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- Danish Ministry of Research, Education and Digitalisation — Extensive unauthorized access to citizens’ CPR data (October 2026, in Danish)
- The Register — ‘123456’ password linked to Denmark data breach affecting 8.8M people (October 13, 2026)
- DR Nyheder — Funen company at the centre of massive CPR data breach (October 9, 2026, in Danish)
- Berlingske / Ritzau — Three profiles at the company used the code “123456” (October 9, 2026, in Danish)
Photo: Dan Nelson, Pexels (Pexels licence).