A single compromised vendor account just exposed personal records on 8.8 million people, more than Denmark’s entire population, pulled from the country’s national identity register. The attacker says an AI model wrote the program that did it, and a basic coding bug accidentally spared an entire birth year from exposure.
What Happened
Danish authorities disclosed on October 5 that hackers abused a private company’s legitimate access to the Central Person Register, or CPR, the database that assigns every resident, deceased person, and emigrant a unique identification number. The breach exposed names, addresses, and CPR numbers tied to roughly 8.75 million records, according to figures the attacker provided to Danish newspaper Politiken. That total includes about 5.5 million living people and 3.3 million deceased ones, out of the roughly 11 million records the CPR holds. Denmark’s actual population is about 6 million.
The compromised account belonged to Pays ApS, a small Odense-based data services firm that helps business customers verify addresses, deaths, and relocations through CPR lookups. Managing director Sophie Laursen confirmed on October 9 that an external party had misused the company’s authorized access. Between September 10 and September 20, the intruder ran roughly 14 million automated searches, 8.75 million of which returned usable records. Nobody caught it in real time. A ministry staffer discovered the breach on October 2 after noticing an unusually large invoice tied to Pays’s search volume, 12 days after the activity had already stopped.
Politiken later reported that at least three Pays accounts, including an administrator account, used the password “123456.” Separately, a person claiming responsibility told the paper, through an encrypted chat conducted in English, that they got in using a leaked password belonging to a former Pays employee. Danish authorities have confirmed neither account of how the attacker got in, nor the attacker’s identity. Digitalization Minister Christina Egelund called the incident “extremely serious” and ordered a review of the CPR system’s security controls. Datatilsynet, Denmark’s data protection authority, and the National Special Crime Unit are both investigating.
The attacker also told Politiken that artificial intelligence wrote the extraction program, a script more than 40,000 characters long, saying “any AI model launched within the past year or so would be able to do it.” Two experts who reviewed the code for Politiken agreed it looked AI-generated. The clearest evidence: a bug sent the program searching for people born in 1877 instead of 1977, so the leaked dataset is missing an entire birth year by accident.
Why It Matters
None of the attacker’s claims, about the password, the AI tooling, or the stated intent not to sell the data, have been independently verified by Danish authorities. But the pattern underneath them is familiar. CPR numbers function in Denmark the way Social Security numbers function in the United States: as both a universal identifier and, in practice, a stand-in for proof of identity. Banks, employers, hospitals, and landlords all request it. Once a number like that leaks at population scale, treating it as a secret stops making sense, because tens of millions of other parties already hold it too. Danish cybersecurity specialist Jan Kaastrup told broadcaster TV 2 that the CPR number’s role as an implicit secret is now simply “broken.”
That is also why the discovery method matters as much as the breach itself. Fourteen million automated queries ran over ten days through one vendor account, and nothing in the CPR system’s monitoring flagged it as abnormal. An invoice surfaced the intrusion, not a security alert. The pattern echoes other 2026 incidents, including the Thomson Reuters court-records exposure and a string of vendor-credential breaches across healthcare and law firms, where the attacker broke nothing technical. They simply used access that was already there.
The AI detail is the part generating headlines, and it deserves scrutiny rather than alarm. A 40,000-character script that enumerates sequential ID numbers and pulls matching records is not a sophisticated exploit. What AI assistance plausibly did was compress the time and skill needed to write that script from days to minutes, not invent a new attack method. The century bug, mistaking 1977 for 1877, is a two-digit-year error that has dogged software since long before large language models existed, apparently inherited now by the tools that write software today.
Our Take: Our take is that the password and the AI detail are the least important facts in this story, even though they are the most quotable. The real failure is structural: a government handed broad, standing search access to a small vendor with no apparent limit on query volume, no real-time anomaly detection, and no requirement for multi-factor protection on an account that could enumerate an entire nation’s population. Fixing the password would not have fixed that. Denmark’s advice to lean on MitID and one-time codes instead of the CPR number is the right move, but it is also an admission that the number itself is now permanently compromised for roughly 8.8 million people.
Expect more governments to face this same reckoning as AI tooling keeps lowering the cost of mass-scale enumeration attacks against databases built around a single, static identifier. The institutions that get ahead of it will be the ones that stop treating identity numbers as secrets and start treating vendor access itself as the perimeter worth watching.
The post Denmark’s Hackers Didn’t Need Skill, They Needed an AI and a Bad Password appeared first on DataFLOQ.
