Media: Program behind CPR leak was created by artificial intelligence

An anonymous person claiming to be behind the hack of Denmark's CPR register says the program used to pull the data was written by artificial intelligence. The claim was made to the newspaper Politiken, which had two experts review the program. It runs to more than 40,000 characters, and the experts judged that its code was indeed AI-generated. The alleged hacker said any AI model launched in the past year could do the same, and that the attack was not especially difficult.

Danish authorities said last week that, over roughly ten days in September, outsiders gained access to names, addresses and CPR numbers for just over 8.7 million people. The program retrieved 8,749,975 CPR numbers. According to the alleged hacker, access came through a website belonging to Pays ApS, a company in Odense on Funen, using login details found in a leaked password from a former employee. Pays confirmed to TV 2 on Friday that it was the company that was compromised.

Politiken reported that at least three profiles at Pays used the password "123456", based on a review of the data leak the hacker says was used. One of them was the company's administrator account. The alleged hacker told the paper they have no plans to sell or leak the information.

The person denies having strong technical skills, pointing to a mistake in the code: the AI program searched for people born in 1877 instead of 1977. As a result, CPR numbers for people born in 1977 are missing from the material shared with Politiken. Pays' director, Sophie Laursen, has not answered Politiken's questions about the company's security.

Private companies and associations can get access to the CPR register if they need address details on customers or members. The Central Business Register lists two employees at Pays ApS as of July 2026.