-6.png?w=1024)
A trusted account, not a broken system
Denmark's Central Register of Persons, known as CPR, holds roughly 11 million records covering current residents, former residents and the deceased. It is the backbone identifier Danish banks, hospitals, municipalities and private firms use to look up who someone is. Pays ApS, a private company, held a legitimate commercial account that let it query CPR on behalf of its own customers, the kind of access arrangement that underpins countless government-adjacent data products. That account is what got abused.
Pays ApS managing director Sophie Laursen confirmed on October 9 that the company's CPR access had been misused. According to documents obtained by the Danish newspaper TV 2, an unauthorized party had access for about 21 days and 17 hours starting September 10. Roughly 14 million automated lookups ran through the account during that window. The unauthorized activity reportedly stopped around September 20, but the account itself stayed active until October 2, when authorities finally terminated it, meaning the hole in the fence stood open for nearly two weeks after the intrusion itself had stopped.
How 8.8 million records got out the door
Authorities caught the breach the mundane way enterprises usually catch account abuse: billing anomalies. Officials noticed unusually high charges for the company's CPR searches, which triggered a review. The breach notification reached Denmark's Data Protection Agency, Datatilsynet, on October 4, and the government disclosed the incident publicly the next day. Mikkel Leihardt, a department head at the Ministry of Research, Education and Digitalisation, walked through the discovery at a press conference on October 6.
The scope is substantial: names, addresses and CPR numbers for about 8.8 million people, a figure that includes deceased and former residents and so exceeds Denmark's living population of roughly 6 million. Protected names and addresses, the kind Danish citizens can request be shielded from lookups, were excluded from what leaked. That is a meaningful mitigation, but it still leaves an entire country's identifying records in the hands of someone who was not supposed to have them, with no indication yet of how the data has been or will be used.
The password problem underneath the AI story
The person claiming responsibility told the Danish newspaper Politiken they obtained a leaked password that belonged to a former employee at a Danish company. Politiken separately reported that at least three Pays ApS accounts, including an administrator account, used the password 123456. Authorities have confirmed the account itself was misused, while leaving the precise entry point unconfirmed, which is exactly the ambiguity that makes the detail land so hard: a vendor holding privileged access to a national identity system, exposed by the kind of credential hygiene that any routine enterprise security review would flag within minutes of looking.
This is the part CTOs should sit with longer than the AI angle. A government agency can harden its own infrastructure extensively and still inherit the weakest password of the weakest account among the third parties it has granted standing access to. The CPR breach did not require defeating Denmark's systems at all. It required one commercial partner with an administrator login that a password-strength checker from a decade ago would have rejected on sight.
What the AI-generated code actually tells us
The attacker says they used an AI-generated program to retrieve 8,749,975 CPR numbers. Two independent experts examined more than 40,000 lines of the code and concluded it appeared to be AI-generated, based on its structure and style, though that assessment speaks to the code's apparent origin, not to whether the attacker's claimed record count is accurate. Authorities have not confirmed the extraction total, and the gap between a verified code sample and an unverified outcome is itself worth noting: the forensic conclusion that a tool looks machine-written travels faster through headlines than the harder, slower work of confirming what that tool actually pulled out the door.
There is a telling wrinkle: Politiken reported the program contained a bug that mistakenly searched for people born in 1877 instead of 1977, meaning CPR numbers tied to the 1977 birth year are reportedly missing from the material the attacker has shared. It is a small detail with a large implication. AI coding assistants lower the floor for building a working data-exfiltration tool, but they do not raise the ceiling on an attacker's own carelessness, and that same carelessness is now baked into whatever dataset is circulating. For enterprises weighing how much AI lowers the skill bar for attackers against their own systems, this incident is a useful, concrete data point rather than a hypothetical.
The vendor-access blind spot enterprises keep skipping
Every large enterprise has its own version of Pays ApS: a payroll processor, a background-check vendor, an identity-verification service, a claims administrator, each holding standing, programmatic access to a system that matters. Those relationships typically get reviewed once at onboarding and then left alone unless a contract renewal forces another look. The CPR breach shows what three weeks of unmonitored automated access can produce when nobody is watching query volume on the other end.
The practical fix is not exotic. Rate-limit and alert on query volume anomalies for every third-party account with programmatic access to sensitive systems, require credential rotation and strength enforcement on vendor admin accounts as a contractual condition, and build billing or usage spikes into the same alerting pipeline as security logs instead of leaving them for finance to flag weeks later. None of that required anyone to predict an attacker would eventually reach for an AI-written script. It only required treating a vendor's access path with the same ongoing scrutiny an internal privileged account would get, and auditing, this year, how many of your own vendor accounts have gone untouched since the day they were provisioned.
