Denmark’s CPR administration said in October 2026 that unauthorised persons had obtained names, addresses and CPR numbers of about 8.8 million registered persons in the Central Register of Persons, the national ID register, by misusing a Danish company’s lawful access to search it.
The person who says they did it told the Danish newspaper Politiken they used the password ‘123456’, and Politiken reported on 9 October that the company, Pays on Funen, had at least three profiles with that password.
Business Pill · GUARDRAILS
A one-minute explainer of guardrails: how limits on a system are set and enforced. It teaches the general idea only and says nothing about any organisation in this story.
The key insight: As we read it, the register was reached through a door it had opened on purpose: by the government’s account the access ran through one private company’s lawful search rights, and the person claiming it says the lock on that door was the password ‘123456’.
What the Government Said
The Ministry of Higher Education, Science and Digitalisation said the CPR administration became aware on the evening of Friday 2 October 2026 of irregular activity in the CPR system during September, and learned over the weekend that the unauthorised access covered names, addresses and CPR numbers of about 8.8 million registered persons, a figure it said includes the living, people who have emigrated and the dead.
The ministry said the CPR system today holds about 11 million registered persons. It said the access did not cover the names and addresses of people registered with name and address protection, that the company’s access had been stopped, that the case had been reported to the data protection authority Datatilsynet, and that it is being investigated by the police.
Minister Christina Egelund called it “en dybt alvorlig hรฆndelse” (a deeply serious incident) and said she had asked for a thorough security review of the CPR system.
How the Access Worked
The ministry said the intruders used a private Danish company’s lawful access to search the CPR system, within the information private companies are allowed to receive. Under section 38 of the CPR Act, it said, private companies with a legitimate interest may receive data on a defined group of people they have already identified individually.
TV 2 reported, citing the CPR office’s notification to Datatilsynet, that the access began on 10 September, lasted 21 days and 17 hours in total, and appears to have stopped on 20 September, 12 days before it was discovered. It reported that about 14 million searches on CPR numbers were made through the small company’s access.
TV 2 reported that a ministry department head, Mikkel Leihardt, said the breach was found because a staff member came across a very high invoice indicating an unusually large number of lookups.
The Password Claim
Politiken reported that the hacker, who shared the data with the newspaper, said they used the password ‘123456’ to reach the CPR numbers and addresses of 5.5 million living and 3.3 million deceased Danes. Its headline said the company had at least three profiles with that password.
The Register reported that the person said they had no intention of selling or leaking the data, that Pays’ managing director Sophie Laursen confirmed on 9 October that its access had been exploited, and that the government did not respond to questions about the alleged password failings.
On 9 October the CPR administration reminded companies with CPR access of the security terms: they must have a security officer and keep continuous control of, and follow, the number of lookups in CPR.
The Structural Read
As we read it, the breach did not need to defeat the register itself: by the ministry’s account it ran through a private company’s lawful search access, the kind of authorised channel section 38 of the CPR Act allows.
As we read it, the detection came from billing rather than monitoring: TV 2 reported that the 14 million searches were noticed through an invoice, and the CPR administration’s 9 October notice now asks companies to follow the number of lookups themselves.
As we read it, this is the same kind of authorised access that software agents act through: our reporting this week covered agents on Tencent Cloud probing a map service and AI agents paying through x402 on Base; a weak password on one authorised account sits in the same position.
Christina Egelund, Denmark’s minister for research, education and digitalisation, in the ministry’s press release
“Det er en dybt alvorlig hรฆndelse”
Three Implications
COMPANIES WITH REGISTER ACCESS The CPR administration’s 9 October notice says companies with CPR access must have a security officer and keep continuous control of, and follow, the number of lookups in CPR.
CITIZENS The ministry reminded people never to hand over passwords or other confidential information on calls or e-mails, even when the caller appears to know their name, address and CPR number.
INVESTIGATORS The ministry said the case was reported to Datatilsynet and is being investigated by the police; The Register reported that Pays’ managing director confirmed on 9 October that its access had been exploited.
The Business Engineer Lens
This story maps onto the Business Engineer framework Inside Anthropic’s Permission Layer.
The framework puts it this way: “The governance layer sits at the intersection of capability, regulation, national security, access control, and geopolitical alignment. It is where decisions are made about who gets access to frontier intelligence, under what conditions, and for which purposes.”
As we read it, the CPR case is access control at national scale: the decision about who may query the register was delegated to company accounts, and, by the claimed hacker’s account, one account’s password decided the rest.
What Is Not Established
The password detail comes from the person who claims the breach, as told to Politiken; the government has not confirmed it in anything we read, and Politiken’s full article is behind a paywall. Politiken put the total at just over 8.7 million CPR numbers; the government’s figure is about 8.8 million registered persons.
We read no statement naming who the person is or whether the data has been shared further. The police investigation is under way, according to the ministry.
The Bottom Line
Denmark’s government says names, addresses and CPR numbers of about 8.8 million registered persons were obtained through one company’s lawful access to the national register, and the person claiming the breach told Politiken the key was the password ‘123456’.
TV 2 reported, citing the CPR office’s filing, that the searches ran from 10 to 20 September and were noticed on 2 October, when an invoice showed the volume of lookups.
95,000+ executives read Business Engineer for the AI strategy frameworks cited by ChatGPT, Claude, and Perplexity.
A note on sourcing. We read the Danish ministry and CPR administration’s press release in full (in Danish), the CPR administration’s 9 October notice to companies, TV 2’s 9 October report in full and The Register’s 13 October report in full. Politiken’s 9 October article is paywalled beyond its headline and opening, which carry the password claim and the 5.5 million and 3.3 million figures.
The story resurfaced on 15 October in a post by Kalshi, which cites no source. Danish quotes are given in Danish with our translation; the password detail is the claimed hacker’s account as reported by Politiken, not a government finding.
Sources: Danish ministry / CPR administration press release (Oct 2026) · CPR administration notice to companies, 9 Oct 2026 · TV 2, 9 Oct 2026 · Politiken, 9 Oct 2026 · The Register, 13 Oct 2026
