Attackers Accessed CPR Data for 8.8 Million Danes via Company Account
Danish authorities confirmed that unauthorized actors accessed national population records for millions of citizens through a compromised corporate account.
Key points
- Attackers accessed data for approximately 8.8 million people in Denmark's Central Person Register.
- The breach occurred on October 5, involving the exploitation of a private company's lawful lookup rights.
- Exposed information includes names, addresses, and personal identification numbers for both living and deceased individuals.
Denmark’s digitalization ministry confirmed on October 5 that unauthorized parties gained access to the national population register, compromising the personal data of approximately 8.8 million individuals. The breach involved the misuse of a private Danish company’s legitimate access credentials to the Central Person Register (CPR).
According to a report by The Hacker News, the attackers leveraged the company’s lawful right to look up records within the system. This mechanism allowed them to retrieve sensitive information without initially triggering alarms associated with external intrusion attempts. The ministry stated that the compromised data includes names, residential addresses, and personal identification numbers. The scope of the breach is comprehensive, covering records for both living citizens and deceased individuals registered in the national database.
Context and Background
The Central Person Register is a foundational component of Denmark’s digital infrastructure, serving as the primary source for personal identification data across government and private sectors. The incident highlights the risks associated with third-party access to critical national databases. By utilizing a company account that possessed authorized lookup privileges, the threat actors bypassed standard perimeter defenses that typically monitor for unauthorized external entry points.
The digitalization ministry’s announcement on October 5 marked the official confirmation of the data exposure. The scale of the breach, affecting nearly the entire population of Denmark, underscores the severity of the incident. The use of a legitimate corporate account suggests that the attackers may have obtained credentials through phishing, credential stuffing, or other social engineering tactics, although the specific method of initial compromise was not detailed in the immediate reports.
Who Is Affected
The breach impacts approximately 8.8 million people, representing the vast majority of Denmark’s population. The exposed data is particularly sensitive because personal identification numbers in Denmark are used for a wide range of administrative, financial, and healthcare interactions. The inclusion of deceased individuals in the breach indicates that the attackers performed bulk extractions or broad searches rather than targeted queries for specific living persons.
Individuals whose data was accessed are at risk of identity theft, fraud, and other forms of personal data exploitation. The ministry has advised the public to remain vigilant, though specific remediation steps for individual citizens were not fully detailed in the initial summary provided by The Hacker News. The breach serves as a reminder that data security extends beyond technical firewalls to include the management of third-party access and credential hygiene.
What should you do?
The digitalization ministry has issued warnings to the public regarding the breach. While no immediate fix has been confirmed for the underlying access vulnerability, individuals should monitor their personal information for signs of misuse. Organizations that hold similar access to national registers should review their credential management and access logs immediately.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: Denmark
- Monitor bank statements and credit reports for unauthorized transactions or new accounts opened in your name.
- Enable multi-factor authentication on all personal and professional accounts, especially those linked to financial or identity services.
- Be cautious of unsolicited communications requesting personal information, as attackers may use stolen data to craft convincing phishing attempts.
- Review privacy settings on social media and public profiles to limit the amount of personal information available to potential attackers.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many people were affected by the breach?
Approximately 8.8 million people, including both living and deceased individuals, had their data accessed.
What kind of data was exposed?
The exposed data includes names, addresses, and personal identification numbers from the Central Person Register.
How did the attackers gain access?
Attackers used a private Danish company’s lawful right to look up records in the Central Person Register via a company account.
