A leaked "123456" password reportedly let an attacker into Denmark's CPR register, exposing data on about 8.8 million people. It went unnoticed until a bill for 14 million searches arrived.

An attacker reportedly abused Pays ApS's authorized access to Denmark's CPR register using a leaked password tied to a former employee, according to TV 2. The CPR administration called it a serious security incident. Politiken reports the searches exposed data on roughly 5.5 million living and 3.3 million deceased people, about 8.8 million total. Access lasted 21 days, ending October 2, though suspicious activity appears to have stopped September 20. A bill for around 14 million searches drew attention to the breach.

✨ AI summary of the linked source — not editorial content.