The breach itself is confirmed. Danish authorities disclosed on October 5 that names, addresses and CPR numbers of about 8.8 million people were accessed from the Central Register of Persons (CPR), which holds records for roughly 11 million people, including deceased people and emigrants. The "123456" detail comes from the person who says they did it, who told the newspaper Politiken. Pays ApS, a two-employee IT firm in Odense with legitimate access to the register, reportedly had at least three accounts using that password, one of them an administrator account. Documents reported by TV 2 say the searches ran from September 10 to 20, about 14 million automated queries, and were noticed only on October 2 when an unusually large invoice drew attention. Pays confirmed on October 9 that its access had been abused. I haven't been able to verify the password claim independently, so treat it as the attacker's account.
The post's jab at Bitcoin doesn't connect to this. The lesson is about third-party access: a weak password on a vendor account with broad rights, and no alert on heavy query volume. Denmark's agency now says a CPR number can no longer be trusted alone to verify identity, and Danes are being warned about phishing that uses their personal details.
If you're in Denmark, watch for unexpected messages that cite your personal details. Anyone who knows more about how the vendor access was set up is welcome to add it.
