Central Person Register (Product): news timeline & CVEs

`123456’ password used in massive Danish CPR data breach

Hackers reached Denmark's CPR register after at least three Pays accounts, including an admin, used "123456".

Ritzau reports that hackers reached Denmark's Central Person Register (CPR) through the Funen-based IT company Pays. At least three Pays user accounts, including an administrator account, were protected only by the password "123456" when the intruders gained access. The incident is described as a massive breach of the national civil registration system, which holds core identity data on Danish residents.

DataBreaches.netOct 10, 20:42 UTC · 10h agoData breach 16 sources

Hackers steal 8 million citizens’ records from Danish government database

Hackers stole personal records on about 8 million people from Denmark's Central Person Register.

Denmark confirmed that hackers stole most of the contents of its Central Person Register, affecting about 8 million citizens and residents, including people living abroad and the deceased. Stolen data includes names, addresses, and Danish social security numbers used for tax and public services. The register contains records on about 11 million people, some decades old. Unauthorized access came from abusing a Danish company's lawful CPR search rights; the breach occurred in September and was discovered on October 2. Minister Christina Egelund called it a serious incident, and the government has not attributed it.

TechCrunch · Securityupdated Oct 10, 20:42 UTC · 10h agofirst Oct 5, 14:58 UTC · 5d agoData breach 16 sources2

Data breach at Denmark’s national population register exposes 8.8 million people

Unauthorized access to Denmark’s population register exposed names, addresses, and ID numbers for about 8.8 million people.

Denmark is investigating unauthorized access to its Central Person Register that exposed names, addresses, and CPR numbers for about 8.8 million people. The perpetrators used an unnamed domestic company’s legitimate access; officials detected irregular activity on Friday and said the breach occurred during September. The Data Protection Agency, notified Sunday, described a very large number of automated searches aimed at identifying valid CPR numbers, which are lifelong identifiers used for healthcare, banking, and government services. Research and digitalisation minister Christina Egelund ordered a broad security review and extended the national digital-security hotline.

The Recordupdated Oct 10, 20:42 UTC · 10h agofirst Oct 5, 12:00 UTC · 5d agoData breach 16 sources3· 2 reads

Denmark Confirms Major Security Incident Exposing 8.8 Million Citizen Records

Denmark confirmed unauthorized CPR searches exposed names, addresses, and ID numbers of about 8.8 million people.

Denmark confirmed unauthorized access to its Central Person Register affecting about 8.8 million people, including names, addresses, and CPR numbers. The records also cover deceased people and former residents, while name-and-address confidentiality cases were excluded. Attackers abused a Danish company’s legitimate search access rather than directly compromising the registry; that access has been suspended. Irregular activity was detected on October 2 after searches in September, Datatilsynet and police were notified, and officials ordered a CPR security review.

GBHackersupdated Oct 10, 20:42 UTC · 10h agofirst Oct 5, 10:55 UTC · 5d agoData breach in the wild 16 sources

Central Person Register

Timeline4 articles

Appears with

`123456’ password used in massive Danish CPR data breach

Hackers steal 8 million citizens’ records from Danish government database

Data breach at Denmark’s national population register exposes 8.8 million people

Denmark Confirms Major Security Incident Exposing 8.8 Million Citizen Records