Two of this week's largest breaches did not start with a software exploit. In Denmark, someone used a small private company's lawful access to the national population register to pull names, addresses and personal ID numbers for about 8.8 million people. In the UK, ASOS says an attacker obtained an employee's login by impersonating a trusted contact, then used it to reach third-party platforms that hold customer data.
In both cases, the attacker logged in. That makes both of them identity incidents, and both point at the same gap: access that was legitimate on paper and unquestioned in practice.
What happened in Denmark
The Danish CPR administration announced on October 5 that a Danish company's lawful right to search the register had been misused. Names, addresses and CPR numbers for about 8.8 million people, living and dead, were affected. The register holds roughly 11 million records. People registered with name and address protection were not affected for those fields, according to the authority.
Digitalization Minister Christina Egelund said the access ran for about ten days in September. She said safeguards had not been solid enough and that alarms should have gone off. The Copenhagen Post, citing Ritzau, reported that authorities noticed after an unusually large invoice for roughly 14 million searches.
The company, Pays ApS, had two employees as of July 2026. Its owner confirmed to TV 2 that the company's legal access had been abused. Politiken reported that at least three accounts at the company, including an administrator account, used the password "123456." That detail comes from Politiken's review of data the attacker allegedly used. It has not been officially confirmed.
What happened at ASOS
ASOS disclosed the incident to the London Stock Exchange on October 6, after customers received an unauthorized push notification through the ASOS app. According to ASOS, as reported by Infosecurity Magazine, the attacker gained access to an employee account "by impersonating a trusted contact to obtain log in credentials," then used those credentials to reach third-party platforms the company uses to communicate with customers.
ASOS says personal and customer account data was accessed and that payment information was not. Snowflake, whose service hosted some of the data, said the incident did not result from any weakness in its platform. TechCrunch noted that it is not known whether multi-factor authentication was enabled on the affected account.
The common thread: access nobody was watching
The two incidents differ in scale and sector. The identity lessons overlap.
Third-party access is part of your attack surface. A two-person company held query rights to a register covering most of a country. A marketing platform held enough access to send messages to an app's customers. Each external account inherits the sensitivity of what it can reach, not the size of the organization holding it.
Behavior is an identity signal. Roughly 14 million lookups is not normal for a small business account. Per-account baselines, rate limits and alerts on query volume would have turned a billing surprise into a security alert.
Social engineering defeats passwords, strong or weak. The ASOS attacker did not need to guess anything. Phishing-resistant authentication such as FIDO2 security keys or passkeys binds the login to the legitimate site, which raises the cost of tricking someone into handing over credentials. Verification steps for anyone requesting access or resets matter just as much.
Accounts outlive the people who used them. The attacker in the Danish case claimed to Politiken that the entry point was a leaked password belonging to a former employee. That claim is unverified. The risk it describes is real either way: partner accounts are rarely tied to the partner's own offboarding.
What to check this quarter
- 1.List every external organization and SaaS platform with access to customer or citizen data, and who holds those credentials.
- 2.Require phishing-resistant MFA for partner and vendor accounts that reach sensitive data, not only for employees.
- 3.Set per-account usage baselines on high-value data stores and alert or throttle on large deviations.
- 4.Treat any third-party platform that can send messages to your customers as privileged, and review its admin accounts.
- 5.Recertify partner access on a schedule, and remove accounts with no recent, justified use.
Takeaway
Neither attacker had to defeat a strong control. Each needed one valid login and a system that did not question what that login was doing. Give partner and vendor identities the same scrutiny as your own administrators, because attackers already do.
Sources
- Omfattende uautoriseret adgang til borgeres CPR-oplysninger, CPR administration, October 5, 2026
- Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account, The Hacker News, October 6, 2026
- '123456' password used in massive Danish CPR data breach, The Copenhagen Post, October 10, 2026
- ASOS Confirms Data Breach Linked to Stolen Employee Credentials, Infosecurity Magazine, October 8, 2026 (updated October 9)
- Asos confirms breach of customer data after hackers send rogue app notification, TechCrunch, October 8, 2026