Hackers steal records of 8.8 million people from Denmark's population register
Attackers stole personal information on about 8.8 million people from Denmark's Central Person Register, the national database that issues the CPR number Danes use for taxes, health care and banking, the Danish government disclosed on Oct. 5.
The CPR number is the key to most public and private services in Denmark, so the breach exposes residents to impersonation and highly convincing fraud. It is believed to be the largest data breach in Danish history, TechCrunch reported.
What happened
The intrusion took place in September and was discovered on Oct. 2. According to the government, the attackers abused a Danish company's lawful access to search the CPR system, which some businesses use to verify customers' identities. The Danish Data Protection Agency said the attackers used a form of brute-forcing to find valid CPR numbers and then extracted the data linked to each one, BleepingComputer reported.
The register holds about 11 million records, some going back decades, and covers current residents, people who have moved abroad and people who have died. The stolen data includes names, addresses, CPR numbers and other registered information.
The company's access has been blocked, police are investigating and additional security measures have been added to the system. Christina Egelund, the minister for research, education and digitalization, called it an extremely serious incident and said she had briefed a parliamentary committee.
What we don't know yet
The government has not said who is responsible, which company's access was abused or how that company was compromised. It is also unclear whether the stolen data has been offered for sale or published.
Why it matters
National ID registers are attractive targets because a single number unlocks so many services. TechCrunch compared the incident to a 2016 leak affecting millions of Turkish citizens and repeated leaks of data from India's Aadhaar system. Unlike a password, a CPR number cannot easily be changed, so the risk of impersonation will last for years.
What to do
Authorities set up a cyber hotline and published guidance at sikkerdigital.dk. Anyone who has lived in Denmark, including those now living abroad, should assume a caller or emailer may know their name, address and CPR number. Authorities reminded people never to disclose passwords or other confidential information in response to calls, emails or messages, even when the sender knows those details.
