Comment by ano-ther

So it was actually two weaknesses:

* The non-password at a two-person IT company (Pays ApS)

* And then completely unchecked access to the CPR database for 22 days which apparently does not have monitoring or limits if someone tries to access all the records (they must have made some 16k downloads per hour).