>
av.Amit VijayanCYBERSECURITY & RESEARCHLet\u2019s connect
Back to the library

Cyber news

Daily Cyber Threat Brief — October 13, 2026: 8.8M Records Taken in Danish National Registry Breach

AV
Amit Vijayan
11 min read
Thumbnail for: Daily Cyber Threat Brief — October 13, 2026: 8.8M Records Taken in Danish National Registry Breach

🗂️ CASE FILE — October 13, 2026

Lead story: On October 5, 2026, Denmark's CPR administration confirmed a breach of the country's Central Register of Persons affecting information belonging to 8.8 million people — residents, the deceased, and emigrants drawn from a register of roughly 11 million records. The administration said a Danish company's legal access to the CPR system had been abused; Funen-based Pays ApS, whose managing director Sophie Laursen confirmed on October 9 that its access was exploited, held authorized access to validate business customers' records. According to documents obtained by broadcaster TV 2, the attacker gained access on September 10 and ran 14 million automated searches through September 20. The intrusion was not detected until October 2 — twelve days later — when a department staffer picked up an invoice showing unusually high activity from Pays, ministry director Mikkel Leihardt told reporters. The Danish data protection authority Datatilsynet was notified October 4, and the government disclosed the attack October 5. A person claiming responsibility told Danish outlet Politiken they entered through a Pays account protected by the password "123456", that at least three company accounts — including an administrator account — used the same password, and that they had no intention of selling or leaking the data. Pays' website has been taken offline, and the company has not responded to press inquiries about the password claims.

Why it leads: A national population registry is crown-jewel PII — the identity substrate for an entire country — and it appears to have fallen to the weakest link in the business: a six-character password on a third party's account. Fourteen million automated searches over ten days ran unnoticed until an invoice, not a security control, flagged the anomaly. The breach stands as this year's starkest reminder that supply-chain security is credential security, and that nobody audits the small IT vendor with the keys to the national register.

Today's top stories

  • Denmark's national registry breached — 8.8M affected, "123456" password blamed — attacker claims entry via a Pays ApS account using "123456"; 14M automated searches ran Sep 10–20, detected Oct 2; CPR administration confirmed Oct 5. Password claims sourced to the attacker's statement, not yet officially confirmed. (Denmark, breaches)
  • Ahold Delhaize takes global systems offline after cyber incident — disclosed October 12; US brands (Stop & Shop, Food Lion, Hannaford, Giant Food) and European brands (Albert Heijn, Etos, Gall & Gall, Delhaize) disrupted; experts suspect ransomware; repeat of the November 2024 INC Ransom attack that stole 2.2M individuals' data. (Netherlands, retail)
  • Xuanye group turns to H&M after ASOS breach — H&M says it is investigating extortion claims; The Times reports the ASOS attackers targeted the retailer last week; BBC examined stolen ASOS sample data on October 7 (names, addresses, phones, emails, search histories). (United Kingdom, breaches)
  • Critical CVE week in review: Cisco patches 18 flaws (seven critical) across NX-OS and License On-Prem; IBM Langflow OSS gets two CVSS 9.8 RCE fixes; TOTOLINK and TOZED routers carry CVSS 10.0 unauthenticated command injection. (Vulnerabilities)
  • In brief: ransomware trackers list fresh claims against Libre Wireless Technologies (Orova) and hiqbio.com (safepay); Chaos's Astrana Health claim and incransom's Winnipeg hospital claim still await victim statements.

Denmark's national registry breached: 8.8M records, and a password of "123456"

The confirmed facts are bad enough on their own. Denmark's CPR administration — the keeper of the Central Register of Persons, the national identity database — confirmed on October 5 that information belonging to 8.8 million people had been accessed, out of roughly 11 million records covering current residents, deceased persons, and emigrants. The administration said the breach came through a Danish company's legitimate access being abused, without naming the company; Pays ApS of Funen was identified when managing director Sophie Laursen confirmed on October 9 that its access had been exploited. Pays held authorized CPR access to provide services such as validating business customers' records.

The timeline, reconstructed from TV 2's documents and the ministry's press conference: the attacker entered on September 10, executed 14 million automated searches between then and September 20, and was only caught on October 2 — when a staffer noticed an invoice reflecting abnormally high Pays activity. Datatilsynet, the Danish data protection authority, was notified October 4; public disclosure followed October 5.

The "123456" detail comes from the person claiming responsibility, who told Politiken that at least three Pays accounts — including an administrator account — used that password, and claimed no intention of selling or leaking the data. The Danish government has not confirmed the password claim, and Pays has not responded to press inquiries; its website is offline.

Investigation notes
  • Attribution discipline: the "123456" account is the attacker's claim to Politiken, not an official finding. Treat it as credible-but-unconfirmed: it is consistent with the attack pattern (abused vendor credentials, high-volume automated querying) and with the government's silence on the password question, but no authority has verified it.
  • Detection failure: 14 million automated searches over ten days should be a screaming anomaly for any query-logging control. That the trail surfaced via a billing invoice instead of a SIEM alert is the incident's most damning detail — and the most instructive for defenders managing third-party API access.
  • Why a registry breach is different: unlike a retailer breach, registry data is the root identity record — it feeds banks, insurers, and government services. There is no "reissue" for a national ID number; the exposure window stays open for years.

Ahold Delhaize takes global systems offline after cyber incident

On October 12, 2026, Netherlands-based retail giant Ahold Delhaize disclosed "a security issue within its network," saying it was taking some systems offline as a protective measure while external security experts assist the investigation. Physical stores stayed open, but the digital fallout was broad. In the United States, Stop & Shop's website and apps went dark, and Hannaford, Giant Food, and Food Lion saw employee portals disrupted — Stop & Shop staff reported trouble accessing schedules and pay stubs, and a Food Lion internal memo warned stores might be unable to shop, stage, or hand off online orders. In Europe, Albert Heijn, Etos, and Gall & Gall announced they had been dealing with an incident since Sunday evening, with websites, apps, customer service, and logistics cut off — no online orders possible — and Belgium's Delhaize was also impacted. Management filed a formal notice to investors under EU inside-information rules.

What Ahold Delhaize has not said is the nature of the attack. Security researcher Kevin Beaumont told DataBreachToday the incident started roughly a week before disclosure — "they again waited a week to disclose, and again didn't say ransomware" — and experts broadly suspect ransomware. The company pointed reporters to its website statement and said it was "not in a position to disclose additional details." The history raises the stakes: a November 2024 ransomware attack on Ahold Delhaize's U.S. network saw INC Ransom steal personal, financial, and health information of 2.2 million individuals, posting six terabytes of allegedly stolen data to its extortion site in April 2025.

Investigation notes
  • The repeat-victim pattern: two suspected ransomware-grade incidents in under two years at the same retailer — one confirmed, one suspected. If the current incident proves to be ransomware, the question for the post-mortem is what survived the 2024 remediation program and why the same network fell twice.
  • Scale of exposure: Ahold Delhaize serves about 60 million customers weekly across roughly 9,400 stores, with $103 billion in 2025 net sales and 384,000 associates. A multi-brand, multi-country systems shutdown at this scale is a logistics event as much as a security one.
  • Disclosure timing: Beaumont's "a week" observation echoes the 2024 timeline criticism. Whether delayed disclosure reflects caution or chaos, regulators and insurers will ask the same question.

After ASOS, the Xuanye group knocks on H&M's door

The ASOS extortion saga has a second act. On October 12, H&M said it was aware of online claims and is investigating, after The Times reported that the Xuanye group — the previously unknown crew behind the October 6 ASOS attack — targeted the retailer last week. There is no indication so far that H&M's data environment was compromised.

The ASOS incident itself keeps escalating. The attackers sent a push notification through ASOS's own app on October 6 claiming they had "fully compromised" the company's Snowflake instance and linking to a Telegram channel. ASOS confirmed unauthorized activity on third-party customer-communication platforms, social-engineered via an employee account, and acknowledged that basic personal information may have been accessed — while maintaining that payment card details and account passwords were not. On October 7, the hackers contacted BBC News with a sample of stolen data; the BBC's review showed the haul included names, addresses, phone numbers, emails, search data, and customer numbers. ASOS has roughly 17 million customers. Snowflake has said its platform was not breached.

Investigation notes
  • The new extortion playbook: hijacking the victim's own push-notification channel turned millions of lock screens into a ransom note — the company cannot quietly ignore a demand the press and its customers see simultaneously. Expect this tactic to spread; write access to customer-engagement platforms is now proven ransom leverage.
  • Evidence check: the Snowflake compromise remains unconfirmed by ASOS or Snowflake; the BBC-verified sample proves customer data theft but does not prove the source system. Keep the two claims separate.
  • H&M exposure: as of October 12, H&M says only that it is investigating. Watch for a filing with Swedish or EU regulators before treating the claim as a breach.

Critical CVE week: Cisco, Langflow, and unauthenticated router RCE

ThreatAft's October 6–12 roundup catalogs a heavy week for enterprise and edge flaws. Cisco's October bundle covered 18 CVEs across NX-OS and License On-Prem, including seven rated critical. IBM Langflow OSS (versions 1.0.0–1.12.2) carried two CVSS 9.8 remote-code-execution vulnerabilities; 1.12.4 is the fixed release, 1.12.3 the minimum. TOTOLINK X6000R and TOZED X300 routers shipped CVSS 10.0 unauthenticated command-injection flaws, while the AAS Edge Client vendor recommended decommissioning because no patch will be released. IBM Guardium disclosed five CVEs (four at 9.8) and IBM DataPower Gateway eleven (two at 9.8 code execution). Financial and billing surfaces were in scope too: Sipay Virtual POS signature flaws and PHPNuxBill subscriber-data/RADIUS issues.

Investigation notes
  • Patch-order logic: unauthenticated network RCE first — TOTOLINK/TOZED and Langflow instances exposed to the internet are the week's highest-exploitation-risk surface, followed by Cisco NX-OS in data centers.
  • Edge exposure context: Shodan currently shows roughly 663,000 exposed NetScaler instances, 373,000 FortiGate appliances, and 117,000 Exchange servers worldwide — the internet-facing edge footprint that turns weeks like this one into mass-exploitation events.

In brief

  • Tracker claims: HookPhish's ransomware trackers list fresh October 12–13 claims — Orova against Libre Wireless Technologies (India) and safepay against hiqbio.com (US). Attacker claims only, unverified.
  • Still watching: no victim statements have surfaced in our reporting for the Chaos group's 1.5 TB Astrana Health claim (October 9) or incransom's Health Sciences Centre Winnipeg listing (October 10).
  • Yesterday's lead: the Japan–Korea breach wave (10.8M+ records) — see yesterday's brief for the full case file.

Incident timeline — September 10 to October 13, 2026

DateEvent
Sep 10, 2026Attacker gains access to Denmark's CPR system via Pays ApS credentials, per TV 2 documents.
Sep 10–20, 202614 million automated searches run against the CPR registry.
Oct 2, 2026Danish ministry staffer spots anomalous Pays invoice activity; CPR intrusion detected.
Oct 4, 2026Datatilsynet, the Danish data protection authority, is notified.
Oct 5, 2026CPR administration confirms breach affecting 8.8 million people; government discloses.
Oct 6, 2026Xuanye group sends "ASOS HACKED" push notification via ASOS's own app.
Oct 7, 2026BBC News reviews stolen ASOS data sample (names, addresses, phones, emails, search data).
Oct 9, 2026Pays ApS managing director confirms the company's CPR access was exploited.
Oct 12, 2026Ahold Delhaize discloses network security incident, takes systems offline; H&M says it is investigating Xuanye group claims.
Oct 13, 2026The Register reports the "123456" password claim tied to the Danish registry breach; this brief published.

Source links

Keep exploring.

All articles
Daily Cyber Threat Brief — October 12, 2026: 10.8M Records Leak in Japan–Korea Breach Wave as Attackers Weaponize AIDaily Cyber Threat Brief — October 11, 2026: FBI Arrests Ransomware Negotiator as Third ShinyHunters SuspectDaily Cyber Threat Brief — October 10, 2026: Chaos Ransomware Claims 1.5 TB of Astrana Health Patient Data